Systems and Methods for Watermarking Software and Other Media

ABSTRACT

Systems and methods are disclosed for embedding information in software and/or other electronic content such that the information is difficult for an unauthorized party to detect, remove, insert, forge, and/or corrupt. The embedded information can be used to protect electronic content by identifying the content&#39;s source, thus enabling unauthorized copies or derivatives to be reliably traced, and thus facilitating effective legal recourse by the content owner. Systems and methods are also disclosed for protecting, detecting, removing, and decoding information embedded in electronic content, and for using the embedded information to protect software or other media from unauthorized analysis, attack, and/or modification.

RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/737,428, filed Apr. 19, 2007, which is a divisional of U.S. patentapplication Ser. No. 09/629,807, filed Jul. 31, 2000 (now abandoned),which claims priority from U.S. Provisional Application No. 60/146,420,titled “Software Watermarking Systems and Methods,” filed Jul. 29, 1999,and is related to commonly-assigned U.S. patent application Ser. No.09/629,546, titled “Software Self-Defense Systems and Methods,” filedJul. 31, 2000 (“the Software Self-Defense application”), each of whichis hereby incorporated in its entirety by reference.

COPYRIGHT AUTHORIZATION

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD OF THE INVENTION

The present invention relates to the protection of electronic content.More particularly, the present invention relates to systems and methodsfor watermarking computer software or other electronic content for thepurpose of identifying content or controlling its use, and fordetecting, tracing, and resisting attacks.

BACKGROUND OF THE INVENTION

Advances in microelectronics and networking technology have enabled thedevelopment of increasingly complex computer systems. The software thatcontrols these systems or operates thereon has also become exceedinglycomplex. As a result, companies often spend large sums to develop thesoftware that they sell to consumers or use in commerce. Yet software,like other forms of electronic content—such as digital music, images,video clips, and text—can be easily modified, copied, and distributedwithout the permission of its creator.

Although encryption is often used to prevent the unauthorized use ofelectronic content, encryption is insufficient to protect content at alltimes, since the content must be decrypted before it can be used for itsintended purpose, and once decrypted, can be saved, modified, copied,and/or transmitted to others in unencrypted form.

Content can also be protected by marking it with special identificationinformation. The added information may, for example, identify the personto whom the content was sold. If all authorized copies of the contentinclude such identification information, then someone who attempts tocopy or sell the content without the creator's permission can beidentified by examining the identification information found in theunauthorized copies.

Thus, a person wishing to distribute unauthorized copies of theelectronic content may try to avoid detection by removing theidentification information, or by forging the identification informationof an innocent party. To avoid such attacks, content owners often try tohide the identification information, and/or to embed it in such a waythat removing it from the content will render the content useless orless desirable.

Information that is added to electronic content in the manner describedabove is often referred to as a “watermark,” by analogy to the marksused by paper manufacturers to indicate the origin and quality of theirpaper. There are a number of fundamental differences, however, betweendigital watermarks and paper watermarks, including differences in theway the watermarks are applied and used, and in the properties that thewatermarks possess.

While increasing attention has been paid to the development oftechniques for watermarking digital images and digital audio and videocontent, relatively little attention has been paid to the development oftechniques for watermarking software. Moreover, the watermarkingtechniques that have been developed for electronic content, and softwarein particular, are often relatively complicated to apply and/orrelatively easy to defeat. What is needed are systems and methods formore efficiently and/or more robustly embedding information in softwareand other electronic content. Improved systems and methods are alsoneeded for detecting, extracting, and decoding information embedded insoftware or other electronic content, and for using the embeddedinformation to manage and enforce the rights and interests of thecontent owner.

SUMMARY OF THE INVENTION

The present invention provides systems and methods for embeddinginformation in software and/or other media such that the information isdifficult for an unauthorized party to detect, remove, insert, forge,and/or corrupt. The embedded information can thus be used to protectcontent by identifying the content's source, thereby enablingunauthorized copies or derivatives to be reliably traced, and thusfacilitating effective legal recourse by the content owner. Systems andmethods are also disclosed for protecting, detecting, removing, anddecoding the embedded information, and for utilizing the embeddedinformation to, e.g., protect software or other media from unauthorizedanalysis, attack, and/or modification. It should be appreciated that thepresent invention can be implemented in numerous ways, including as aprocess, an apparatus, a system, a device, a method, or a computerreadable medium. Several inventive embodiments of the present inventionare described below.

In one embodiment, obfuscation techniques are used to impede anattacker's attempts to understand the structure and/or operation of aprogram. In general, these techniques also make watermarks moredifficult to identify, remove, and/or replace, as they typically make itmore difficult to deduce the importance, or lack thereof, of particularcode sequences to the program's correct operation. Tamper resistancetechniques are also used to make it difficult for attackers to analyzeor modify a program without detection. The present invention alsoprovides methods for making watermarks blend in with the rest of theprogram, thus making it difficult for an attacker to spot the watermarksin the program's static image. The present invention also provides avariety of techniques for resisting specific attacks, includingcollusive and auto-collusive attacks. The systems and methods of thepresent invention also can be used to make it difficult for an attackerto use knowledge gained from one successful attack to mount another.

In one embodiment, a system and method for watermarking a computerprogram (or other piece of electronic content) is provided. The programis “primed” by inserting a sequence of code that is operable to producea distinctive pattern. The primed program may then be compiled ortransformed in some other manner. The primed program is then watermarkedby finding the distinctive pattern, and inserting watermarkinginformation at a location indicated thereby. In one embodiment, thesequence of programming code is inserted via a macro or inlinedfunction, and comprises a sequence of executable machine languageinstructions.

In another embodiment, a method for inserting a plurality of copies of awatermark into a computer program is described. Each copy of thewatermark is combined with a different, quasi-randomly-selected number,or “salt,” and the combination is encrypted and embedded in the program.A digital signature of the watermark copy may also be included in thecombination. In one embodiment, an unencrypted copy of the salt is alsoembedded in the program with the encrypted combination. A watermark canbe detected by decrypting the encrypted combination and identifying therelationship between the decrypted copy of the watermark and thesignature, and/or between the decrypted salt and the unencrypted copy ofthe salt.

In another embodiment, a method for watermarking copies of a computerprogram is disclosed. A unique combination of obfuscatingtransformations is applied to a copy of the computer program, theobfuscating transformations being operable to create a unique“signature.” Other copies of the computer program can also be obfuscatedwith other unique combinations of transformations. An individual copy ofthe computer program can be identified by detecting the signature leftby the obfuscating transformations that were applied to that copy.

In another embodiment, a method for detecting a watermark embedded in anexecutable software file is described. The watermark is detected bysequentially proceeding through the executable file looking fordistinctive registration information associated with the watermark. Inone embodiment, portions of the executable file are decrypted, and theresulting decrypted value is analyzed to see if it satisfies apredefined relationship. If it does, then the decrypted value is deemedto be part of the watermark. The process of decrypting and analyzingportions of the executable file can be repeated until the entirewatermark is retrieved.

In yet another embodiment, a method for watermarking a piece of softwarein a manner designed to resist a collusive attack is described.Watermarks are encoded as a sequence of multi-bit symbols, wherein eachsymbol is selected from a predefined alphabet. In a preferredembodiment, the length of the sequence, the size of the alphabet, andthe number of bits in each symbol are selected in relation to anexpected number of colluders. This encoding technique is simpler thanthe Boneh-Shaw encoding technique, and is shorter in length if theexpected number of colluders is small.

In another embodiment, a method for protecting a programinstance-specific watermark (or fingerprint) from collusive attacks isdescribed. The method involves performing a number of obfuscatingtransformations on the program—such as rearranging the program's basicblocks, inserting opaque predicates, rearranging the program's controlflow graph, and the like—to create a number of different programversions. Instances of each version can be marked with instance-specificwatermarks. The number of expected colluders can be used to determinehow many versions to create.

In another embodiment, a method for watermarking and distributing apiece of software is described. The software is divided into at leasttwo portions. Copies of the first portion are distributed to consumers,and copies of the second portion are individually watermarked andmaintained in a database. When a consumer wishes to activate his or hercopy of the first portion of the software, the consumer contacts thedatabase administrator and asks for a copy of the second portion. Thecopy of the second portion is combined with the copy of the firstportion, either on the consumer's computer system or at a remote server,and a record is maintained of the unique watermark contained in the copyof the second portion that was used. In some embodiments, additionalwatermarks can be embedded in the copy of the second portion before itis combined with the consumer's copy of the first portion.

In another embodiment, a method is provided for protecting watermarks ina computer program from unauthorized detection or modification. A numberof obfuscating transformations are performed on the program beforeand/or after watermarking, and one or more self-checking or othertamper-resistance mechanisms are added to the program. Mechanisms fordetecting debuggers or other analysis tools may also be added.

These and other features and advantages of the present invention will bepresented in more detail in the following detailed description and theaccompanying figures which illustrate by way of example the principlesof the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be readily understood by the followingdetailed description in conjunction with the accompanying drawings,wherein like reference numerals designate like structural elements, andin which:

FIGS. 1A and 1B show a general process for inserting watermarks into,and extracting watermarks from, a piece of software or other content.

FIG. 2 illustrates the general process of creating a piece of software.

FIG. 3 illustrates the structure of a generic executable program.

FIG. 4 illustrates the structure of a typical computer system.

FIG. 5 illustrates the use of an error-correction technique to encode awatermark.

FIG. 6 shows the use of a watermark registration scheme in accordancewith an embodiment of the present invention.

FIG. 7 shows the use of a tag-based watermark registration scheme inaccordance with an embodiment of the present invention.

FIG. 8 illustrates a watermark encoding scheme in which the watermarkcontainer is used to provide registration information.

FIG. 9 illustrates the use of encryption to hide watermark information.

FIG. 10 illustrates a salt-based encryption technique for encodingwatermarks in accordance with an embodiment of the present invention.

FIG. 11 illustrates a sparse space watermark encoding technique inaccordance with an embodiment of the present invention.

FIG. 12 illustrates a system for extracting a watermark encoded in themanner shown in FIG. 11.

FIGS. 13A and 13B further illustrate a sparse space encoding anddecoding technique in accordance with an embodiment of the presentinvention.

FIG. 14A illustrates a collusion-resistant encoding scheme in accordancewith an embodiment of the present invention.

FIGS. 14B and 14C illustrate a layered watermarking scheme in accordancewith an embodiment of the present invention.

FIG. 15A shows the general form of an illustrative inert-code watermarkholder.

FIG. 15B illustrates the use of a plurality of macros to create spacefor a multi-bit watermark, and the encoding of such a multi-bit mark inaccordance with an embodiment of the present invention.

FIG. 16 illustrates the use of inlined functions to insert watermarksinto a piece of software in accordance with an embodiment of the presentinvention.

FIG. 17A illustrates a watermark created using a library of atomic,null-effect primitives.

FIG. 17B illustrates a system and method for watermarking a programusing statistical analysis to select stealthy mark holders and/or marks.

FIGS. 18A and 18B illustrate statistical modeling techniques inaccordance with embodiments of the present invention.

FIG. 19 shows the general format of an instruction on the Intel 80×86platform.

FIG. 20 illustrates a watermarking technique that makes use of thedirection bit on the Intel 80×86 platform.

FIGS. 21A and 21B illustrate the encoding of watermarks by permutingprogram elements.

FIG. 22 illustrates an original-based watermarking scheme in accordancewith an embodiment of the present invention.

FIG. 23 illustrates a technique for retrieving watermarks in accordancewith an embodiment of the present invention.

FIG. 24 is a flow chart illustrating a watermark insertion technique inaccordance with an embodiment of the present invention.

FIG. 25 further illustrates the watermark insertion technique shown inFIG. 24.

FIG. 26 illustrates a system and method for applying one or morewatermarks to a program in accordance with one embodiment of the presentinvention.

FIG. 27 is a flow chart of a method for applying one or more watermarksto a program in accordance with one embodiment of the present invention.

DETAILED DESCRIPTION

A detailed description of the invention is provided below. While theinvention is described in conjunction with several embodiments, itshould be understood that the invention is not limited to any oneembodiment. On the contrary, the scope of the invention is limited onlyby the appended claims and encompasses numerous alternatives,modifications, and equivalents. For example, while embodiments aredescribed in the context of a system and method for watermarkingsoftware, those skilled in the art will recognize that the disclosedsystems and methods are readily adaptable for broader application. Forexample, without limitation, the present invention could be readilyapplied in the context of watermarking other types of protected content,such as audio, video, or textual files. In addition, while numerousspecific details are set forth in the following description in order toprovide a thorough understanding of the present invention, the presentinvention may be practiced according to the claims without some or allof these details. Finally, for the purpose of clarity, certain technicalmaterial that is known in the art has not been described in detail inorder to avoid obscuring the present invention.

1. Overview

The present invention provides systems and methods for watermarkingsoftware and other media, such that the watermarks are difficult forunauthorized parties to detect, remove, insert, forge, and/or corrupt.Watermarking is closely related to information hiding techniques such assteganography and fingerprinting, and indeed, the precise dividing linebetween these techniques is somewhat ill-defined. Thus, for ease ofexplanation, and unless otherwise clear from the context, the term“watermarking” will be used to refer to information hiding and/orembedding techniques in general, and is intended to encompass what somepractitioners may classify as watermarking, steganography,fingerprinting, and/or other information hiding or embedding techniques.

FIGS. 1A and 1B show a general process for inserting watermarks into apiece of software or other content (the “substrate”), and for retrievingwatermarks from the same. As shown in FIG. 1A, the watermarking processcan be divided into two general steps: encoding step 102 and embeddingstep 106. In encoding step 102, the information 100 that is going to beinserted into the substrate—commonly referred to as the payload—istransformed in some predefined fashion to make it more resistant toattacks and/or retrieval errors. Encoding step 102 often involvestransforming the payload into a sequence of one or more “marks” 104, amark being the unit of information that is independently embedded in, orextracted from, the substrate (and typically also the unit of detectionby attackers). In embedding step 106, the encoded payload—possiblyconsisting of a set of marks 104—is inserted into the unwatermarkedprogram 105. The marks may be embedded in contiguous locations withinthe program, or may be distributed throughout the program. In contrastto the encoding step 102, embedding step 106 is usually performed in amanner that is specific to the substrate.

As shown in FIG. 1B, the process of retrieving the payload from a pieceof watermarked content can also be divided into two general steps:extracting step 110 and decoding step 112. In extracting step 110, theencoded payload 104′ is retrieved from the watermarked content. Indecoding step 112, the encoded payload 104′ is decoded to recover theoriginal payload 100′. It should be appreciated that FIGS. 1A and 1B areprovided to aid and organize the explanation of certain embodiments ofthe present invention. Some of the components shown in FIGS. 1A and 1Bmay be optional in some embodiments, and the distinctions between thesteps shown in FIGS. 1A and 1B may be blurred or non-existent inpractice.

When watermarking a piece of software, care should be taken to avoidadversely affecting the software's performance. While a certain amountof delay may be tolerable, incorrect program execution typically willnot. Thus, effective software watermarking techniques—like effectivetechniques for watermarking other media—should take reasonable steps toreduce or minimize the amount of perceptible differences between thewatermarked and the unwatermarked versions of the software, and betweendifferently-watermarked copies of the software. Stated differently, itwill generally be desirable to maintain functional equivalence betweendifferently watermarked copies of a piece of software and the original,unwatermarked program. It should be noted, however, that equivalence isnot an absolute notion. For example, if a program includes code thatreceives two inputs, processes them, and generates an output, a firstinstance may take the inputs 2 and 2 and yield 4, while a secondinstance may take 2 and 2 and yield 5, and a third instance may take 2and 2 and yield 6. Under a strict definition of equivalence, theseprograms would not be equivalent, as they produce different results forthe same input. However, if one is only interested in whether the resultis a positive or a negative number, such programs could be consideredequivalent. Thus, the watermarked program need not be identical to theoriginal program to be considered its equivalent, and will generallyhave a variety of observable differences when executed on a computer.For example, different values may be stored in particular RAM locations,execution times may be different, and/or different results may becomputed. However, an effective software watermarking technique willstrive to maintain equivalence between the behavior observed by a userof the unwatermarked software and the behavior observed by a user of awatermarked version of the software, both in terms of the resultsgenerated by the software, and preferably also in terms of the amount oftime and space the software consumes while generating those results.

1.1. Threats and Countermeasures

In a general sense, an “attacker” can be seen as anyone who attempts touse a program in an unauthorized manner. For example, an attacker mightbe a person who attempts to make or distribute unauthorized copies of apiece of software, or a person who attempts to use one of thoseunauthorized copies. An attacker might also be a person who attempts tomodify a program to perform functions that the author did not intend theprogram to perform, or for which the attacker has not obtained thenecessary permissions. An attacker might also be a competitor of thesoftware's author or owner, who wishes to misappropriate portions of thesoftware or to undermine the software's effectiveness. Watermarkingtechniques can be used to resist, prevent, and/or detect some or all ofthese general attacks, and thus, at a more specific level, an attackercan be seen as a person who attempts to circumvent the protectionoffered by a watermarking scheme.

There are a variety of attacks that might be mounted against awatermarking scheme. To the extent a watermark is used to identifyattackers or to prevent certain uses of the watermarked content, anattacker may attempt to remove the watermark or replace it with another,valid watermark. Similarly, if a watermark is required in order to usethe content in certain ways, an attacker may attempt to add such awatermark to unwatermarked content in order to gain access to therestricted features. Thus, there is a need for systems and methods whichare resistant to both unauthorized removal and unauthorized addition ofwatermarks. In many cases, the means for resisting these attacks will bethe same or closely related.

Attackers might apply a variety of static, dynamic, manual, or automaticattacks to detect, remove, and/or forge marks. For example, an attackermight examine the static binary image of the program in order todetermine how the program operates and what each particular programmingconstruct does. Or the attacker might simply look for unusualprogramming constructs, and focus his analysis there. An attacker mightalso examine the execution of the program dynamically, using, e.g., adebugger or other specialized tool, in an attempt to further understandthe program's operation and the purpose of the individual programmingstatements and data structures contained therein. For example, anattacker might search for code that is never used or that has nopractical effect on the program's execution. Having found such code, anattacker might simply remove it.

An attacker might also compare two instances of a program, looking fordissimilarities between the two. If the programs contain differentwatermarks—for example, if the programs are watermarked with informationregarding the identity of their respective users—these differences willshow up on comparison. An attacker might then change one program tocontain the watermark of the other, or might remove both watermarks.This type of attack is known as a collusive attack, and is particularlydifficult to defend against.

As described in more detail below, the present invention providessystems and methods for creating watermarks that are resistant to someor all of these attacks. For example, in one embodiment obfuscationtechniques are used to impede an attacker's attempts to understand thestructure and/or operation of a program. In general, these techniquesalso make watermarks more difficult to identify, remove, and/or replace,as they typically make it more difficult to deduce the importance, orlack thereof, of particular code sequences to the program's correctoperation. Tamper resistance techniques can also be used to make itdifficult for attackers to analyze or modify a program withoutdetection. Similarly, special measures can be taken to make thewatermarks themselves blend in with the rest of the program, thus makingit difficult for an attacker to spot them in the program's static image.The present invention also provides a variety of techniques forresisting specific attacks, including collusive and auto-collusiveattacks. The systems and methods of the present invention also can beused to make it difficult for an attacker to use knowledge gained fromone successful attack to mount another.

1.2. Program Structure and Formation

The design of optimal watermarking techniques typically requires anunderstanding of the media into which the watermarks are to be inserted.In the case of software, this involves understanding the structure ofthe program that is to be watermarked.

FIG. 2 illustrates the general process of creating a computer program.The initial stage of generating a program typically consists ofdetermining what the program is supposed to do and how the program willdo it. The output of this stage may be a set of flow charts, algorithms,or other plans 202. Computer programs are typically written by humanprogrammers, who take the flow charts and other program requirements andwrite a series of programming statements that describe the steps acomputer should perform in order to produce the desired behavior (204).Computer programs are typically written in a high-level programminglanguage like C, C++, Java, or the like, and the code generated by theprogrammer is often referred to as the source code (206). After theprogrammer has finished writing the program 206, a preprocessor may beused to expand certain shorthand notation used by the humanprogrammer—such as macros, inlined functions, or file inclusions—byinserting additional source code into the program (208). Thepreprocessor thus typically produces an expanded source code version ofthe program (210). A compiler is then used to translate the high-levelsource code 208 into low-level, machine-specific instructions 214 that acomputer's processor can understand and execute (212). Once the programis compiled, a linker 216 can be used to associate the compiled programwith additional modules—such as library modules—that have already beencompiled. The output of the linker is an executable program 218 that canbe loaded into memory and run by an appropriate processor.

The resulting executable program 218 contains machine languageinstructions that a microprocessor can execute. The format of anexecutable program will typically vary depending on the hardwareplatform and/or operating system on which the executable program isdesigned to run. Due to the relative ubiquity of computer systems thatuse Intel® microprocessors and the Microsoft® Windows™ operating system,many of the examples and illustrations set forth herein will, for easeof explanation, be modeled after the Portable Executable (PE) formatused by those systems; however, it will be appreciated that the conceptsdescribed herein are generally applicable to other platforms.

FIG. 3 illustrates the structure of a generic executable program in aformat similar to the PE format. FIG. 3 is provided for purposes ofillustration, and one of ordinary skill in the art will appreciate thatactual executable programs will typically differ somewhat from thegeneric program shown in FIG. 3, depending on the platform and operatingsystem on which they are designed to run.

As shown in FIG. 3, an executable file 300 typically includes a header302 that contains a variety of information about the rest of theexecutable, such as the number of sections contained in the executable,and the size, name, and location of each section. The function of header302 is analogous to the table of contents of a book.

Executable file 300 also includes a text or code section 304 containingthe machine code of the program. For purposes of illustration, and toimprove readability, the “machine code” shown in FIG. 3 has been writtenin the more human-readable, assembly language form, as is standardpractice. Each of the human-readable instructions shown in FIG. 3translates into a machine language instruction, which is actually abinary sequence of 1 s and 0 s (or at an even more fundamental level, aset of voltage levels in a computer system's memory).

As shown in FIG. 3, machine language instructions consist of two generalparts: the operation code (or opcode) 306 and the operands 307. Theopcode specifies the operation that is to be performed, while theoperands specify the data that are to be operated upon, or the locationsof these data. The set of opcodes that a given processor will recognize,and the operands that these opcodes will accept, are typically publishedby the manufacturer of each microprocessor. For example, informationregarding the opcodes available for the Intel 80×86 family ofmicroprocessors can be found in the Intel Architecture SoftwareDeveloper's Manual, Volume 2: Instruction Set Reference Manual, IntelOrder Number 243191 (1999).

Referring once again to FIG. 3, an executable program 300 also typicallyincludes a data section 310. Data section 310 contains the data that areused by the program. These data may be stored statically with theprogram, or may be generated dynamically during program execution.

Executable 300 may also include relocation information 312, a symboltable 314, and debugging information 316. Relocation information 312identifies the instructions and data in program 300 that depend onabsolute addresses. If instructions or data are moved to a differentaddress, the relocation table can be used to adjust these addressesappropriately. Thus, the relocation table is typically useful for otherprograms, such as debuggers or linkers. Similarly, symbol table 314contains information about the names and locations of functions,procedures, global variables, labels, and the like. Debugginginformation 316 contains a variety of information for use by debuggingtools. For example, debugging information 316 typically includesinformation that enables a debugger to map machine language instructionsto their source-code counterparts. Although relocation information,symbol table(s), and debugging information are often generatedautomatically by a compiler, it is generally possible for thisinformation to be removed from an executable program without affectingthe program's operation, since the information contained in these tablesis typically not used at runtime.

A typical executable file may also contain a variety of othercomponents. For example, executable file 300 may contain an import tableand/or an export table listing the external references that are made bythe program or the internal locations that can be referenced by outsideprograms, respectively. An executable file 300 may also contain jumptables, virtual function tables, index tables, and the like. Moreinformation on the components of executable files is readily available.For example, information regarding the PE file format can be found in“Microsoft Portable Executable and Common Object File FormatSpecification,” rev. 6.0, Visual C++ Business Unit (Microsoft 1999)(seealso, http://msdn.microsoft.com/library/specs/msdn_pecoff.htm). Asdescribed in more detail below, the format of the executable file andthe intricacies of the microprocessor's instruction set will typicallyoffer a variety of opportunities for the application of watermarkingtechniques.

Programs are typically distributed to consumers or other users inexecutable form. This allows the consumer to simply load the programonto a computer and use it, without needing to first compile the programinto machine-readable form. Distributing executable code, rather thansource code, also makes the underlying details of the program'soperation more difficult for an attacker to understand or modify.However, some programs are distributed in source code form or in otherrelatively high-level forms. Thus, the present invention provides avariety of systems and methods for applying watermarks, some of whichare applicable generally to code in whatever form it is distributed, andothers of which are specific to a given code form (e.g., source ormachine code) or processor/operating system platform.

FIG. 4 illustrates the structure of a typical computer system, such asthat which could be used to execute a piece of watermarked software,and/or to apply watermarks to a piece of software using the tools andtechniques described herein. As shown in FIG. 4, system 402 willtypically include:

-   a processing unit 416;-   system memory 418, usually including high speed random access memory    (RAM), read-only non-volatile memory (ROM), and a bulk non-volatile    storage unit (e.g., a hard disk and/or flash memory) for storing    programs and data for use and execution by processing unit 416;-   one or more input/output devices, such as:    -   network interface 410 for communicating with other systems via a        network 403 such as the Internet;    -   I/O port 412 for connecting to one or more peripheral devices;        and/or    -   one or more disk drives 414 for reading from, and/or writing to,        diskettes, compact discs, DVDs, and/or other computer-readable        media;-   a user interface 426, including a display 428 and one or more input    devices, such as keyboard 406 and mouse 408; and-   one or more internal buses 440 for interconnecting the    aforementioned elements of the system.

The operation of system 402 is controlled primarily by programscontained in system memory 418 and executed by the system's processingunit 416. For example, system 402 might contain an operating system andone or more watermarked or unwatermarked application programs. If system402 is being used to apply watermarks to a piece of software, or toextract watermarks therefrom, it might also contain, e.g., a binary codemodification tool for modifying the executable image of a program,and/or a variety of programs or modules that implement or embody thetechniques described herein. It should be appreciated that while FIG. 4sets forth an illustrative system for practicing embodiments of thepresent invention, other systems with different architectures anddifferent configurations of subsystems could also be used. For example,embodiments of the present invention can be practiced using only alimited subset of the components shown in FIG. 4. Accordingly, it shouldbe understood that the system shown in FIG. 4 is intended to beillustrative and not limiting.

2. Payload

As discussed above, the information conveyed by a watermark is commonlyreferred to as the payload. The payload may contain virtually any typeof information, including, for example, information that identifies thewatermarked item, its owner, its licensee, and/or the terms of thelicense. Watermarks can also be used in connection with special hardwareand/or software to control access to software or other content, thespecial hardware and/or software checking for the presence of thewatermark and enforcing whatever rules or controls are explicitly orimplicitly contained therein. For example, use could be made oftechniques such as those described in commonly-assigned U.S. Pat. No.5,943,422, entitled “Steganographic Techniques for Securely DeliveringRights Management Control Information Over Insecure CommunicationChannels,” issued Aug. 24, 1999 (“the '422 patent”), and/or U.S. Pat.No. 5,892,900, entitled “Systems and Methods for Secure TransactionManagement and Electronic Rights Protection,” issued Apr. 6, 1999 (“the'900 patent”), both of which are hereby incorporated by reference intheir entirety. In some embodiments the payload is encrypted orotherwise encoded as described in more detail below.

The system designer will typically want to control access to theinformation contained in the payload. That is, the system designer willwant to control who is able to read the watermark and/or what they areallowed to know about the watermark-reading process. The systemdesigner's choices on these issues may influence the nature of theencoding and embedding steps that are used to insert the payload intothe substrate.

2.1. Privately Readable

One option is to make the payload privately readable. This can be done,for example, by encoding or inserting the payload using a secret key ortechnique. This type of watermark may, for example, be used for forensicpurposes, where it is not necessary to delegate the task of detectingand/or extracting the watermark to potentially untrusted or insecuredevices or entities. A privately-readable watermark may containinformation such as the software's serial number, information about theuser and/or the transaction by which the user acquired the software, orvirtually any other type of information. In general, the payload caneither carry this information explicitly, or carry an index into aseparate database that stores the information.

2.2. Publicly Readable

A “publicly-readable” watermark is one which a user/client's device iscapable of detecting and/or extracting—possibly on-the-fly—for purposesof e.g., authorizing certain uses of the watermarked item, providing aninformation channel, or the like. A publicly-readable (and/orpublicly-writeable) watermark may, for example, be used in situationswhere a consumer's content-rendering device is expected to makedecisions regarding the allowable uses of a piece of content based onthe presence, absence, or contents of one or more watermarks. Thus, apublicly-readable watermark may be used in situations where thewatermark payload consists of rules and controls that govern thecontent's use, or the like.

In general, watermarks intended for detection by client-side watermarkreaders will be more susceptible to certain attacks, since theclient-side watermark reader will typically afford an attacker theopportunity to perform experiments, without risking detection, toidentify the watermark and/or to determine how the watermark wasembedded. In contrast, with a privately-readable watermark the attackerwill typically not have a convenient, risk-free mechanism by which hecan determine whether his attempts to identify and/or remove thewatermark have been successful.

In general, a client-side watermark reader will either be a “black box”or a “white box.” A black box reader simply accepts content and userinput, and returns the watermark payload or information indicatingwhether the watermark payload was detected. A black box reader typicallyrelies on obfuscation and/or hardware or software tamper resistancemechanisms to shield the details of the watermark detection process fromthe user's view. In contrast, a “white box” reader is one for which thealgorithmic details of the watermarking process have been published tothe user, or included in hardware or software that can be readilyexamined and/or reverse-engineered. As a result, white-box readerstypically rely on relatively strong watermarking techniques that cannotbe easily compromised by a person with detailed knowledge of thewatermarking algorithm.

3. Encoding and Decoding

In a general sense, watermark “encoding” is the process of determininghow a watermark's payload bits are represented. The encoding processcan, to a large degree, be considered independently of the medium intowhich a watermark is inserted, although the sizes of the marks may begoverned somewhat by the substrate and the embedding techniques that areused.

A watermark payload may be encoded in various ways. For example, tofacilitate robust protection and/or recovery of the payload, additionalinformation can be added to the payload and/or the watermark containerto provide registration; noise tolerance; resistance to deletion,cropping, correlation, and/or collusive attacks; resistance to forgery;and/or other functionality.

The decoding process is closely related to the encoding process.Decoding takes information and noise that were extracted from thesubstrate and transforms it back into the original payload. Thus, in ageneral sense, the decoding step can be thought of as the inverse orcomplement of the encoding step, as the decoding step reverses the workperformed by, and the information inserted during, the encoding step toreconstitute the watermark payload from the encoded marks. If theencoding process involves a secret key (e.g., for anti-forgery oranti-collusion purposes), the decoding process will generally also usethat key (or a related key) and possibly a database of encoded payloadsto, e.g., recover watermarks that have been corrupted by collusion orcropping.

A variety of encoding and decoding techniques are set forth below,organized generally according to the functionality that they provide. Itwill be appreciated, however, that the categories given below areprovided primarily to organize the discussion. The categories are notrigid, and many of techniques fit within more than one category and/orprovide additional functionality.

3.1. Error Correction

In many cases, it will be desirable to detect and recover a watermarkeven if storage and transmission errors have corrupted the substrateand/or the watermark, and even if an attacker has tried to forge orremove the watermark by changing or deleting portions of it and/or thesubstrate in which it is embedded. To make a watermark withstand suchthreats, error correction techniques can be used, including withoutlimitation, such well-known techniques as repetition, Hamming or otherlinear block codes, cyclic codes, quadratic residue codes, Golay codes,Reed-Mueller codes, Reed-

Solomon codes, convolutional codes, trellis codes, and the like. A basicidea of such techniques is that by including redundancy in acommunication stream, the corruption or loss of some of the informationin the stream can be corrected or detected. The present inventionapplies this insight to the context of software watermarking by treatingthe watermarked substrate and/or the sequence of marks itself as thecommunication stream, and encoding the watermarks using error correctiontechniques to facilitate their recovery in the face of noise ormalicious tampering.

As shown in FIG. 5, for example, one error-correction technique is toembed multiple copies of each mark in the substrate. If one or more ofthe copies is corrupted or deleted, the correct value of the mark can bedetermined by taking the majority value of each of the copies that aredetected. Referring to FIG. 5, a program fragment 500 is shown in whichthe illustrative watermark “Alice's Program” 504 has been embeddedmultiple times. As shown in program fragment 502, if an attackerdiscovers one instance of watermark 504 and attempts to alter it (e.g.,by changing it to say “Bob's Program”), the correct value of thewatermark can be recovered by examining each of the marks, and selectingthe mark that appears the most times (i.e., “Alice's Program”).

As another example, if each mark is relatively unique—as might be thecase if each mark were generated using the sparse space encodingtechniques described in more detail below—then even if an attacker wereable to change or delete several copies of the mark, as long one copyremains (or even portions of one copy), it may be possible to recoverthe correct mark with a relatively high degree of confidence. Thus, markrepetition is particularly effective in resisting deletion, cropping,and forgery attacks, since if redundant marks are spread throughout theprogram it will be difficult for an attacker to inhibit watermarkdetection simply by removing a portion of the program or forging a fewmarks. As the number of redundant marks is increased, the effortrequired to find, remove, or forge each copy (or a majority thereof)will generally increase as well.

It will be appreciated that there are a variety of other ways to applyerror correction techniques in the context of watermarking, and that forpurposes of practicing the present invention any suitable technique orcombination of techniques can be chosen. For example, multiple copies ofeach mark can be included in the program, as described above, and eachmark may itself be encoded using error correction codes such asReed-Solomon codes, Hamming codes, or the like. An advantage ofspecial-purpose error correction/detection codes such as Reed-Solomoncodes and Hamming codes is that the redundant information included inthese codes is typically not as easily recognizable as repeated,verbatim occurrences of the mark, and thus marks encoded using thesespecial-purpose codes will typically be less susceptible to certainattacks. In addition, special-purpose error correction codes typicallyrequire less overhead than simple mark repetition—that is,special-purpose codes may require less additional information to beinserted into the substrate for a given level of error tolerance.However, simple repetition will typically be somewhat easier toimplement, and may thus be preferable for many applications.

3.2. Registration

Registration refers generally to the process of providing information tofacilitate the location and retrieval of a watermark. Registrationinformation can be provided in a variety of ways. One registrationtechnique is to embed a suitably predefined sequence of bits in thesubstrate, the sequence indicating the location of the watermark. Anillustrative implementation of this technique is shown in FIG. 6.Referring to FIG. 6, a watermark comprising the value “123456789A” isembedded in a piece of software 600. The watermark could, for example,represent the serial number of the software or information about thesoftware's user. In the example shown in FIG. 6, the watermark is splitbetween two marks 604 and 606. Each mark is preceded by a tag 608comprising the predefined value “50505050.” The watermark is found bylooking for the predefined value.

To ensure that the tag does not collide with other values that occur inthe program, the unwatermarked program can be checked for the presenceof a proposed tag, and if an occurrence is found, another tag can beused instead. In other embodiments, tag sequences that collide withother values in the program are tolerated, and may even be desirable asa means of disguising the tags. In such embodiments, the tags could formpart of a multi-part detection process in which a combination of tagsand other registration information are used to recover watermarks fromthe program.

Another registration technique is to insert registration bits into thesubstrate as part of a watermark's payload. For example, a fixed (andpreferably secret) tag can be added to each mark:

Mark=Payload Data+Tag

where “+” may comprise a simple concatenation or a more complexcombination technique. As shown in FIG. 7, for example, mark 702consists of the payload data “1234” concatenated to a tag consisting ofthe value “50505050” and spanning both operands of instruction 706. Asanother example, mark 710 is formed by interleaving the sequence“56789A” and the tag “50505050.”

If the substrate is uniformly random, the inclusion of T bits of tag canreduce the probability of a false hit by 2^(−T), where a “false hit”refers to the mistaken determination that noise or other substrate datais actually a valid mark. If unique tags are chosen from a predefinedset, tag repetition can be avoided, thus making it more difficult for anattacker to detect and/or remove the tags.

Registration information can also be provided by the container itself.For example, if it is known that a watermark is embedded as a predefinedset of operands in an identifiable sequence of opcodes, the marks can befound by looking for the sequence of opcodes—the opcode sequence thusproviding the registration information for the watermark. This techniqueis illustrated in FIG. 8, in which a sequence of three consecutive XORinstructions 802 comprises the watermark container and also providesregistration information, thus allowing a tag 804 (if any) to consist ofa smaller, perhaps less noticeable value.

Marks can also be inserted without providing explicit registrationinformation in the program. For example, marks can be stored atpredefined locations in the program. The entity responsible forretrieving the watermarks can maintain a list of the locations at whichthe marks are stored for each instance. Marks are retrieved byconsulting the list. The marks in different instances of the program canbe stored at different locations, and a key can be maintained for eachinstance, the key indicating where the marks are stored. In suchembodiments the external list (or key) effectively supplies theregistration information.

It will be appreciated that a variety of related registration encodingscould be used in addition to, or instead of, the techniques describedabove. For example, error correction techniques can be applied to theregistration information to prevent its removal, and the resultingdifficulty in extracting marks from the program. Or, a combination ofseveral registration techniques can be used to provide greaterresolution in locating a mark and greater resistance to certain attacks.

3.3. Encryption

As shown in FIG. 9, encryption is an effective technique for hidingeasily-recognizable watermark information, thus making it difficult foran attacker to find the payload by simply examining the program's staticimage. Referring to FIG. 9, the illustrative watermark “Alice's Program”900 is encrypted using a suitable encryption function 902 and key 904.The result is encrypted string 906, which is inserted into program 908instead of the unencrypted watermark 900. An attacker will generally beunable to retrieve and decode the watermark without knowing theencryption key. Since individual marks will often be relatively small,it will often be acceptable to use a relatively lightweight encryptionmethod, such as a one-time pad. However, stronger encryption techniquescan also be used.

3.4. Salt

As seen in FIG. 9, even if a mark is encrypted, if it appears severalplaces in the program it may still be detectable by an attacker whoemploys a collusive attack or looks for repeated patterns. Although theattacker may not be able to decode the mark, the attacker could remove,forge, or tamper with it. The present invention provides techniques forresisting such attacks.

Specifically, in one embodiment extra information, or “salt,” is used tomake different copies of the same mark appear different. The salt may,for example, consist of a randomly chosen 16 or 32 bit value, or anyother suitably-sized value. In one embodiment salt is simply added orconcatenated to each instance of the mark, and the result is thenscrambled. For example:

Mark=Encrypt (Salt+Payload Bits)

Since many encryption algorithms yield a random or effectively randomoutput for each unique input, adding a different salt to each copy ofthe payload reduces the likelihood that different copies of the payloadwill encrypt to the same or similar values. Thus, S bits of salt can beused to provide approximately 2^(S) unique copies of the payload.Because different copies of the same mark will now appear different, anattacker will find it more difficult to detect all copies of a givenmark even if the attacker is able to deduce the identity of one suchcopy.

FIG. 10 illustrates the use of salt. As shown in FIG. 10, multiplecopies of the payload “Alice's Program” are inserted into program 1002.However, before each copy is inserted, it is combined with a different,possibly randomly-generated, salt (1010, 1011, 1012) and encrypted(1014). In a preferred embodiment, an encryption technique such as DESor triple-DES is used, although it should be appreciated that anysuitable encryption technique could be used, including the well-knowntechniques set forth in Menezes et al., “Handbook of AppliedCryptography,” pp. 191-319 (CRC Press, 1997), which is herebyincorporated by reference. The result of the encryption process is a setof different marks (1006, 1008, 1009). Because each copy of the mark isdifferent, when the marks are placed into program 1002 their presenceand identity will be more difficult to discern.

Salt can also be helpful in resisting forgery. If different copies of amark are encoded using a different salt, as described above, an attackermight be able to set any one copy of the mark arbitrarily, but willgenerally find it difficult to set many copies of the mark to havedifferent salts but the same payload, since the encryption techniqueand/or the key is secret. Thus, if an attacker tries to forge severalcopies of a mark, the salt recovered from each of the copies is likelyto be the same. The correct value of the mark can then be determinedusing the error correction techniques described previously. For example,if a copy of a program contains three differently-salted copies of amark (e.g., “Alice's Program”), and an attacker were to insert fouradditional copies of a single mark obtained from another program (e.g.,“Bob's Program”), the correct value of the mark (i.e., “Alice'sProgram”) could be recovered by choosing the payload that appears themost times with different salts. Since, in this example, each copy ofthe forged mark has the same salt, that mark would be rejected in favorof the authentic mark.

3.5. Authentication

Digital signature techniques can be used to provide registrationinformation and/or resistance to forgery or other attacks. A signaturecan be included in a watermark, or stored externally by an entityresponsible for detecting the watermark. When a potential watermark isretrieved, it is rejected if the stored signature does not match theexpected value.

In one embodiment the signature is a secret function of the payloadand/or the salt, and can be formed using well-known digital signaturetechniques. For example, use could be made of the well-known DigitalSignature Algorithm (DSA) or any of the other techniques described inSchneier, “Applied Cryptography,” 2d ed., pp. 483-502 (John Wiley & Sons1996), which is hereby incorporated by reference. It will often beunnecessary to use public-key cryptography to create the signature,however, since the entity checking the signature will typically know thekey that was used.

The general form of a signature-containing mark might be:

Mark=Encrypt (Salt+Payload+Signature).

The watermark decoder checks for the expected signature after decryptingthe mark. Such an encoding provides a way to check each copy of thepayload for validity, and also can be used to provide registrationinformation when the container does not do so, as may be the case with adata-section watermark. If the container provides some relatively weakregistration information, the signature can be used to filter out falsehits. As with tags, T bits of signature can reduce the probability of afalse hit by 2^(−T). To resist malicious tampering, in one embodimentthe encryption of the signature depends on all other bits (salt andpayload), so that any change to the encrypted watermark is highly likelyto corrupt the signature upon decryption. This can be done in a varietyof ways, including by using a block-based cryptographic algorithm withblocks big enough to include the entire watermark, by using a chainedcryptographic algorithm such as DES-CBC with the signature placed at theend, and/or by using a hash-based scheme.

Another illustrative signature technique is shown below. In thisexample, the mark stores a plaintext version of the salt and anencrypted concatenation of the salt and the payload, giving thestructure:

Mark=Salt+Encrypt(Salt+Payload)

When the mark is retrieved, the encrypted value is decrypted, and thedecrypted payload is accepted if the decrypted salt matches theplaintext salt. Thus, the salt is effectively used as a signature todetect whether the mark or the salt have been modified. For security, itwill generally be preferable for the payload to affect the encryption ofthe salt, and vice-versa.

A variety of other signature techniques could also be used. For example,the signature could be a predefined, fixed tag. This technique iseffectively the result of combining tag-based registration andsalt-based anti-correlation. The tag need not be secret since theencryption key is secret. For example, the tag could be all zeroes. Thewatermark detector decrypts a potential mark and checks for the tag. Ifthe tag is present, the payload is accepted; otherwise, it is rejected.The technique is simple, yet powerful if the cryptographic algorithm issufficiently secure. To the extent the tag is a known value, however,this technique may be prone to partially-known plaintext attacks on thecryptographic algorithm. If the tag is kept secret, a known-plaintextattack will generally not be possible, although a partially-fixedplaintext attack might be used. In another, slightly more complex,embodiment, the signature is computed by hashing the salt and thepayload. Although any suitable hashing technique could be used, in oneembodiment the hash is computed as the piecewise XOR of the salt and thepayload. For additional secrecy, the hash could be computed usingencrypted versions of the salt and the payload. Many other signaturetechniques could also, or alternatively, be used.

3.6. Sparse Space Encoding

Another encoding technique is to allocate watermark payloads randomlyfrom a large space, thus making it difficult for an attacker to randomlyguess a valid watermark. For example, a watermark payload could berepresented as a 1024 bit string. Such a string represents 2¹⁰²⁴different combinations. If, for example, only 17 million of thosecombinations are actually used, then the odds are quite small(approximately one chance in 2¹⁰⁰⁰) that an attacker will be able toguess or randomly generate a valid combination. Since the strings arepreferably allocated randomly (or quasi-randomly), even an attacker withknowledge of one valid string will find it difficult to deduce the valueof another. It will be appreciated that the bounds of the sparse spacecan be optimized for the particular application, there typically being atradeoff between string size and resistance to attack, where longerstrings will generally be more difficult to embed, but more difficultfor an attacker to guess.

FIG. 11 illustrates a sparse space encoding technique. Referring to FIG.11, a set of desired payloads 1102—in this example, a sequence of serialnumbers—are mapped onto a set of numbers 1104 chosen randomly orquasi-randomly from a large range. In the example shown in FIG. 11,numbers 1104 are 1024 bits long (i.e., 256 hexadecimal digits). Theresult is a table 1106 indicating the sparse space number thatcorresponds to each serial number in the original list 1102. Forpurposes of watermarking a piece of software or other content with agiven serial number 1110, the corresponding sparse space string 1112 isinserted into the substrate. If the serial numbers were themselvesinserted into the substrate, an attacker with access to several copiesmight infer their sequential nature and then be able to guess othervalid serial numbers with relative ease. In contrast, when each serialnumber 1110 is mapped to a string from a large range 1104, and thestring is embedded in the substrate, an attacker will have moredifficulty detecting the marks and/or deriving and embedding adifferent, valid value.

FIG. 12 illustrates a watermarking system that makes use of thesparse-space encoding technique described above. Referring to FIG. 12,randomly-selected sparse-space strings 1206, 1208 are associated withpayload information 1210, 1212. The value of each string 1206, 1208 isrecorded in a database 1214, together with the payload information 1212to which the string corresponds (and/or instructions or keys operable totransform the string into the payload). For example, the originalpayload might include information regarding the identity of the programand/or the purchaser (as shown in FIG. 12), the date and location ofpurchase, or the like. The database is maintained by the softwarecreator, the software distributor, and/or another agent 1216 tasked withextracting watermarks from watermarked software instances. When agent1216 obtains a piece of software 1202, agent 1216 extracts the watermark(1220), looks up the value of the watermark string (e.g., 1206) indatabase 1214, and retrieves the associated payload information (1222).It will be appreciated that the general watermark detection andretrieval process illustrated in FIG. 12 can also be used in connectionwith watermarks encoded using other techniques.

By using a sparse-space encoding technique, it can be made arbitrarilyimprobable that an attacker will generate a valid, forged watermark atrandom, and thus the presence of a valid watermark can give the contentowner a reasonable degree of confidence that the watermarked piece ofsoftware is indeed the originally marked instance, or a copy thereof.Thus, sparse-space encoding can be used to protect against theunauthorized distribution of software (or other content), as thepresence of a valid mark can be used to reliably identify the source ofthe unauthorized copies, as an attacker will find it difficult to forgea valid mark in an attempt to frame others or evade detection.

A related benefit of sparse-space encoding is that sparse-space stringsare relatively resistant to deletion and/or cropping attacks. As shownin FIG. 13A, for example, a payload 1302 is associated with a sparsespace string 1304. Sparse space string 1304 can be divided into asequence of subparts 1306 a, 1306 b, 1306 d, 1306 e, 1306 n, each ofwhich is embedded in a copy of program 1308, possibly multiple timesand/or using error correction codes. Breaking up the string in thismanner will typically make it more difficult for an attacker to detect.As shown in FIG. 13A each subpart may include an indication of itsposition in the string. In one embodiment the subparts are encoded inthe following form:

Mark_(i)=Encrypt(subpart_(i)+position_(i)+signature(subpart_(i),position_(i)))

where “+” can represent a concatenation or other suitable combinationfunction. The position information allows the subparts to be stored inthe program in any order, and the signature allows the marks to beinserted without additional registration information.

If a portion of the watermark is deleted or corrupted, the portion ofthe watermark that is recovered can be compared to a database ofallocated strings, and the string with the maximal match can bedetermined. The watermark detection process is illustrated in FIG. 13B.Referring to FIG. 13B, upon receipt of a damaged (or undamaged) program1308′, watermark-detection agent 1318 extracts the marks that remain(1320). To extract the marks, watermark detection agent 1318 may use akey indicating where the marks were stored. Or, if the marks are encodedin the manner described above, mark detection agent 1318 may use theself-registration information contained within the marks themselves.That is, watermark detection agent 1318 scans the program forbit-sequences that, when decrypted, exhibit the appropriate signaturerelationship—i.e., include a subpart and a positional indicator that,when signed, equal the signature. It should be appreciated however, thatother registration schemes could be used.

Referring once again to FIG. 13B, having recovered a mark sequence1321—possibly missing some values 1306 a′, 1306 d′ that were deleted orcorrupted—watermark detection agent 1318 searches the database ofallocated strings 1330 for the string (or strings) that matches therecovered string 1321 most closely (1322). In the example, shown in FIG.13B, the closest match is string 1332. Having located the closest match1332, watermark detection agent 1318 retrieves the corresponding payloaddata 1334 (i.e., “Alice's Program”) (1324). Watermark detection agent1318 may also calculate the probability that, given recovered sequence1321, the matching string 1332 is, in fact, the correct match (1326).Well-known probability techniques can be used to make this calculation.Depending on how close the recovered string is to the closest allocatedstring, it may be possible to determine with a relatively high degree ofconfidence which string (if any) the program originally contained. Thus,even if an attacker removes a portion of the watermark, if the watermarkstring is long enough and unique enough, the original watermark canstill be recovered. If the watermark string is encoded using additionalerror-correction techniques, the chances of recovering the original markcan be enhanced.

Having recovered the original watermark 1334, the watermark detectionagent can initiate appropriate action (1328). The action that is takenwill typically depend on the reasons the watermark detection process wasperformed. For example, if copies of the program were being distributedwithout the software creator's permission, the watermark can be used todetermine whose copy of the software was being distributed. The softwarecreator or its agents could then contact that person (i.e., Alice)and/or take other action. As another example, if the program had beendamaged inadvertently, the watermark could be used to confirm theowner's identity before sending a replacement program.

3.7. Collusion Resistance

If otherwise-identical instances of a program contain differentwatermarks identifying the particular program instance (“fingerprints”),the watermarked locations can be detected by simply comparing two ormore instances of the program and noting the locations of thedifferences. As previously noted, such a collusive attack presents apotentially serious obstacle to the effective use of instance-specificwatermarks.

As described below, the present invention provides systems and methodsfor encoding and embedding instance-specific watermarks in acollusion-resistant manner.

3.7.1. A Collusion-Resistant Code

Suppose a content provider wants to distribute a piece of software orother electronic content to u users. The provider embeds a distinctwatermark in the copy given to each user. If some users collude tocreate a new copy of the content that contains a corrupted watermark,the encoding scheme described herein allows the content provider toinfer the identity of at least one of the colluders. The longer thewatermark, the more colluders it can resist.

In a preferred embodiment, the bits constituting the watermark areinserted at secret locations within the software and the contentprovider preferably uses a private decoder to identify the colluder(s).

3.7.1.1. High-Level Structure of the Code

In a preferred embodiment of the collusion-resistant encoding scheme, awatermark is represented as a string of n symbols chosen from analphabet of size q. As shown in FIG. 14A, the code has two layers:

-   -   1. An outer code 1472, consisting of a string of n symbols        chosen from an alphabet of size q.    -   2. An inner code 1474 consisting of a symbol represented as a        string of b bits.

The two-layer structure of this code is similar to that of theBoneh-Shaw code for fingerprinting. See, e.g., Boneh and Shaw,“Collusion-Secure Fingerprinting for Digital Data,” pp. 452-65 (CRYPTO1995)(also appearing in “Lecture Notes in Computer Science,” vol. 963(Springer 1995)). The construction of the outer code is also similar theBoneh-Shaw code; however, the inner code of the present invention ismuch simpler. While this simplicity comes at the cost of increasing thelength of the outer code, n, when resisting a large number of colluders;the code of the present invention may reduce the overall length of thecode when resisting a relatively small number of colluders.

3.7.1.2. The Outer Code

The outer code is preferably random. That is, the watermark assigned toeach user is a string of symbols selected randomly and independentlyfrom the alphabet. The content provider maintains a private databasethat associates user identities with the watermarks that are assigned tothem.

Decoding of the outer code is preferably performed using a maximum-matchtechnique. A watermark f_(r) retrieved from a copy of the watermarkedcontent may be potentially corrupted by colluders. It is compared witheach assigned watermark f_(a) by counting the number of symbols thatmatch between f_(r) and f_(a) (i.e., the “match of f_(a)”). The decoderoutputs the identity of the user who was assigned the watermark with themaximum match.

For purposes of this discussion, a decoder is said to be in error if itdoes not output the identity of a colluder. As shown in Appendix A, theprobability of decoder error, e, can be reduced arbitrarily byincreasing the length n of the outer code, provided that the inner codemeets certain criteria.

3.7.1.3. The Inner Code

A symbol is represented as a string of b bits. For each symbol positionin the outer code (1 through n), a fresh set of q representations isgenerated to encode the q possible symbols in that position. Thus, thereare n*q distinct representations in all. Each representation isgenerated by selecting bits randomly (or quasi-randomly). Theserepresentations are preferably known only to the contentprovider/watermark-encoder.

The inner code is decoded by finding an exact match. In one embodiment,if a symbol position in the retrieved watermark contains arepresentation that does not match any representation generated for thatposition in the database of assigned watermarks, the decoder returns aninvalid symbol. Thus, in this embodiment error correction is notperformed. In fact, since the outer decoder performs match operations onsymbols, the inner decoder need not perform any operation at all.

As shown in Appendix A, the exemplary two-layer code shown in FIG. 14Aresists collusion among c users if the size of the alphabet, q, isgreater than or equal to c, and if the bit-length of each symbol, b, isgreater than c*log(q). If q and b are set to the smallest such valuesfor a desired level of collusion resistance, the symbol-length of theouter code, n, should be chosen to be greater than(14*c^(c+2)*log(u/e)). Although these results are sufficient forcollusion-resistance, they might not be necessary. However, experimentalevidence suggests that if the first condition does not hold (i.e., ifq<c), then increasing the length of the watermark (b or n) isineffective in increasing the collusion resistance of the scheme. Theseresults are derived in the analysis set forth in Appendix A hereto. Itwill be observed that for large c, the length of this code is relativelyinefficient compared to the Boneh-Shaw code, where the bit-length offingerprints is roughly O(c⁴*log (u/e)). However, this code is simplerthan Boneh-Shaw's code, and for small c (as might be the case ifcustomization is applied, as described in the next section), it may beshorter in length.

3.7.2. Customization and the Benefit of Multiple Base Versions

The difficulty of obtaining multiple instances of a program in order tomount a collusive attack can be greatly increased by having manydifferent versions of the original binary. For example, a binarycustomization tool can be used to transform a program into many distinctversions by rearranging basic blocks, applying obfuscation techniques,and/or by performing other customization techniques such as thosedescribed herein and/or in the Software Self-Defense application. Eachversion can, in turn, have its own distinct set of slots into whichwatermark values can be inserted, and can use differentbit-representations for the symbols contained in those slots. If anattacker obtains two different versions of the same original binary,they cannot be easily compared to locate the slots, because the slotsthemselves (as well much of the rest of the binary) will be in differentlocations. In effect, the versions can be made too difficult to compare.

Although customization thus provides a powerful form of resistance tocollusive attacks, in many situations it will be impractical to uniquelycustomize each instance of a program—especially in a commercial settingwhere numerous instances are distributed. Thus, in one embodiment of thepresent invention, practical protection from collusive attacks isobtained by creating a number of uniquely-customized program versions.In order to mount an effective collusive attack, the attacker will thusneed to obtain two or more instances of the same program version, sincecomparing instances of different versions will, due to customization,yield little useful information to the attacker.

If there is only one version of the program, obtaining twodifferently-watermarked instances simply entails obtaining two instancesof the program. However, if there are multiple program versions, the“birthday paradox” characterizes the probability of obtaining multipleinstances of the same version.

The birthday paradox is the somewhat counterintuitive probabilisticobservation that it is necessary to gather only 23 randomly-chosenpeople in order to have a greater than even chance of finding two withthe same birthday (ignoring leap years and assuming all birthdays areequally probable). Applying this insight to collusion-resistant programcustomization, it can be seen that even if there are 365 differentprogram versions, there will be a greater than even chance that anadversary who obtains 23 randomly-selected instances will have twoinstances of one of the 365 versions, and could thus mount a potentiallysuccessful collusive attack. This analysis is generalized below.

For n different versions, the probability of getting at least twoinstances of the same version after obtaining m instances is given bythe formula:

1−n!/(n^(m)(n−m)!)

The probability of getting at least three instances of the same versionis given by the formula:

n^(−m)m!*Sum(0 . . . k . . . m) Choose(n, m−k)*Choose(m−k, k)*2^(−k))

Table 1 shows the number of instances that an adversary would need toobtain in order to find two (or three) instances of the same programversion with a desired probability. For example, as shown in Table 1,when there are 10,000 distinct program versions, the number of instancesneeded to mount a 3-colluder attack begins to become impractical, as anattacker (or group of attackers) would generally need to obtain 184program instances for even a 1% chance of success. Thus, the programdeveloper might use the information in Table 1, or a straightforwardmathematical extension thereof, to choose the appropriate parameters forthe two-layer encoding scheme that was described in the previoussection. For example, the program provider can determine the level ofcollusion that is deemed to be probable given the number of customizedversions that are produced, then select the parameters of acollusion-resistant encoding using this fact and an assessment of thelevel of risk that the program provider is willing to bear.

TABLE 1 Number of Desired Number Expected for Number Expected forVersions Probability Two Identical Three Identical 20 0.5 6 (0.564) 4(0.509) 20 0.1 3 (0.145) 8 (0.114) 100 0.5 13 (0.557) 38 (0.502) 100 0.16 (0.141) 21 (0.112) 1000 0.5 38 (0.5093) 168 (0.5025) 1000 0.1 15(0.1001) 89 (0.1015) 1000 0.01 6 (0.0149) 41 (0.0103) 2500 0.5 60(0.5101) ~304 (0.4957) 2500 0.1 24 (0.1048) 162 (0.1009) 2500 0.01 8(0.1114) 74 (0.0101) 10000 0.5 119 (0.5058) ~760 (0.4991) 10000 0.1 48404 (0.10056) 10000 0.01 15 184 (0.010028) 10000 0.001 5 86 (0.0010016)

3.7.3. Layered Watermarks

As shown in FIGS. 14A and 14B, another technique for resisting collusionis to apply multiple watermarks to each program instance. For example,one or more unique watermarks can be applied to a program at differentstages of the program development and distribution process. Forinstance, the software developer might add one or more watermarks to aparticular version of the program, these watermarks being the sameacross all instances of that version of the program. A second watermarkcan be inserted when the user installs the program, for example, and canbe chosen to be effectively unique for each instance of the program (orfor each instance of that version of the program). The watermarks can belocated by first finding the version-specific watermark, and following apointer, such as pointer 1404, to the location of the instance-specificwatermark. If the watermarks are connected in this manner, theinstance-specific mark can be relatively small, since it need notcontain self-identifying information.

Although an attacker might be able to detect the instance-specificwatermark using a collusive attack, such an attack would typically beunsuccessful in detecting the version-specific watermark, since it wouldbe the same across all instances of that version of the program andwould not stand out upon comparison of two program instances.Accordingly, this technique provides resistance to collusive attacks,and also provides a level of redundancy that is effective in resistingcropping and patching attacks.

It will be appreciated that this technique can be used to create anysuitable number of watermark layers. For example, a program mightcontain three or more layers of watermarks, the watermarks linkedtogether with pointers in the manner shown in FIG. 14B. From a systemperspective, the layers of watermarks create a tree structure, theleaves identifying each instance of the program in an effectively uniquefashion. This is illustrated in FIG. 14C, in which node 1452 of tree1450 represents the original program, nodes 1454 and 1456 representdifferent versions of the program, nodes 1458 and 1460 representdifferent instances of those versions, and so forth. Thus it can be seenthat each instance of the program can contain a plurality ofwatermarks—the layers providing collusion resistance, and themultiplicity of watermarks providing resistance to cropping and patchingattacks. If an attacker is able to remove one watermark, otherwatermarks will remain to identify the program.

Thus, a variety of watermark encoding techniques have been presented.These techniques can be used in the context of software or any othersuitable substrate, and can be used alone or in combination with eachother. The next section describes techniques for embeddingsuitably-encoded marks into a piece of software.

4. Mark Placement and Detection 4.1. Placement

There will typically be numerous locations in a piece of software or itsenvironment in which watermarking data can be inserted. For example,marks can be placed outside the code or data sections, in dead code ordata, and/or in inert code or data. Marks can alternatively, or inaddition, be inserted by making peephole changes to effective code, bymaking refinements to data-types or operations, by modifying the staticcontrol-flow graph, by modifying the program's dynamic behavior, and soforth.

As described below, some placement techniques may require new resourcesto be inserted into the program, while other techniques use existingresources (e.g., techniques like setting scale bits, writing dead orinert code/data over existing NOPs, re-allocating registers, and thelike). The placement techniques set forth below may also providedifferent capacities to hold data. For example, techniques such assetting scale bits, re-allocating registers, and usingsingle-instruction inert code typically provide relatively fine-grainedmarks containing only a few bits each. Other techniques, such as thosethat use longer sequences of inert code, may be capable of containing awatermark's entire payload. In addition, placement techniques may differin their symbol density (i.e., the average number of marks that can beinserted in a program of a given size). However, it will also beappreciated that many of the placement strategies described belowoverlap to some extent, or are closely related.

4.1.1. Introduce New Components

A general technique for watermarking a piece of software is to insertnew code, data, or other components that may serve as watermarks, or maybe subsequently modified to include watermarks. As described below,there are a variety of components that can be inserted for this purpose,and there are a variety of ways to actually insert these components.

4.1.1.1. Unused Components

One type of information that can be added to a program is code and/ordata that are not used during the program's execution. This informationcan serve as a watermark, or can later be modified to include awatermark. A benefit of including a watermark in unused programcomponents is that the addition of the watermark will generally not harmthe performance of the program, although it will increase the program'ssize. A disadvantage of watermarking unused components is that anattacker may be able to identify code that is never executed, or datathat are never used, and then simply alter and/or remove this code ordata, thus removing any marks contained therein.

4.1.1.1.1. Unused Data

One of the simplest watermark containers is a static array of datastored in the data section of the executable. On most platforms,virtually all of the space created in this way is available for thewatermark content. For example, the following macro definition could beused to insert an array of N marks into a program written in the Cprogramming language:

#define InsertWatermark( ) {static int X[N] = {MARK0, MARK1, ...MARKN-1};}

Marks inserted in this manner will typically be able to withstand codeoptimization or instruction substitutions, will generate little if anyruntime overhead, and will be largely platform-independent. Note,however, that if an array of 32-bit words is used, the layout of thebytes constituting each word will typically depend on the byte order ofthe platform. For example, the Intel® 80×86 architecture stores theleast significant byte in the lowest address, while other platforms mayhave a different byte order. Thus, to locate and/or interpret the marks,the platform's byte-ordering scheme should be taken into account. Thesecomplications may be avoided by using an array of bytes rather than anarray of words.

A data section watermark, such as the one shown above, may be somewhatsusceptible to discovery by certain collusive and/or static analysisattacks since the data section of a program is often much smaller thanthe code section. Because current tools for customizing programstypically do not support data section rearrangement, it may berelatively difficult to defend against such attacks.

4.1.1.1.2. Unused Code

Marks can also be placed in unused (or “dead”) code. In one embodiment,basic blocks are inserted containing code that is never executed, andmarks are inserted into these blocks. The unused basic blocks can beinserted between other basic blocks in the program using a binarymodification engine to correct references to the moved code, asdescribed in the Software Self-Defense application, which was previouslyincorporated by reference. Opaque predicates can be used to disguise thefact that certain code is never executed. For example, a jump in theoriginal program can be converted to an apparently conditional jump thatalways evaluates to a predefined value (e.g., “true”) at runtime,although an attacker may be unable to deduce this easily using staticanalysis.

Various techniques can be used to embed marks in unused code. Forexample, marks can be stored as immediate operands of instructions. Inone embodiment the inserted code is made to look like real code byusing, e.g., techniques described in the Software Self-Defenseapplication and elsewhere herein.

Although an attacker may perform static or dynamic analysis to findunused code, or may reorganize basic blocks or insert null-effectinstructions to displace code, these attacks generally require a binaryeditor and will thus be relatively costly and/or time-consuming toperform successfully.

4.1.1.1.3. Manipulating Tables, Debug Info, Relocations and/or Padding

Marks can also be placed in areas other than the code or data sectionsof a program. For example, marks can be placed in program headers,symbol tables, debugging information, jump or relocation tables,import/export tables, virtual function tables, or other locations. Thereare many such areas in the Microsoft PE binary format, and marks can beadvantageously embedded therein using, e.g., a binary code manipulationtool.

For example, one technique is to add watermarking information betweenstructures in the import table. Such structures are defined in the“Portable Executable and Common Object File Format Specification 4.1”(Microsoft, August 1994), and include the Import Directory Table, theImport Lookup Table, the Import Address Table, and the Hint/Name Table.

Another illustrative technique is to take advantage of ordinal-basedaddressing in import tables. Import tables typically have two addressingmodes. In one mode, the import table references a function by storing apointer to the function's name, while in another mode, the import tablereferences a function by simply storing the ordinal value of thefunction's position in the table. Since ordinal addressing consumes lessbits per table-entry than pointer-based addressing, watermarkinginformation can be stored in the unused bits of table entries that useordinal addressing. For example, ordinal values typically consists of 16bits, plus a 1-bit flag indicating that ordinal-based addressing isbeing used, while a pointer typically consists of a 31-bit value, plus a1-bit flag. Thus, ordinal entries include 15 unused bits into whichwatermarking information can be inserted.

It will be appreciated that there are many similar techniques forincluding watermarking information in tables, headers, and the like.

4.1.1.1.4. Add New PE Sections

Another watermarking technique is to simply add new sections to theportable executable file. The new sections can be used to storewatermarking information. An advantage of this technique is that it canprovide a large area for the insertion of watermarks. However, if anattacker discovers that the new PE section is unused, he might simplyremove it. Accordingly, this technique is preferably used in connectionwith self-checking and other tamper-resistance techniques—such as thosedescribed in the Software Self-Defense application—in order todiscourage such an attack.

4.1.1.2. Used Components

Code or data that is used at runtime, but that is ineffective inchanging program behavior, can also be added to the program andwatermarked. Such inert code/data sequences are effectively NOPs, andcan take a wide variety of forms—a PUSH followed by a POP, for example.Marks can be stored in inert code as, e.g., immediate operands, opcodes,memory addresses, and the like. Additional null-effect instructionsequences are described in the Software Self-Defense application, whichwas previously incorporated by reference, and in commonly-assigned U.S.patent application Ser. No. 09/095,346, entitled “Obfuscation Techniquesfor Enhancing Software Security,” filed Jun. 9, 1998 (“the '346application”) and in Cohen, “Operating System Protection Through ProgramEvolution,” Computers & Security, vol. 12, no. 6, pp. 565-584 (1993)(“the Cohen paper”), both of which are hereby incorporated by referencein their entirety.

Although any suitable null-effect sequences can be used, care should betaken to avoid unacceptably degrading the program's runtime performance.For example, the programmer or binary editor should be aware of innerloops or performance-critical basic blocks, and should avoid insertingtime-consuming inert code sequences in those locations.

It will generally be relatively difficult for an attacker to detectand/or remove marks embedded in inert code or data, as such marks willsurvive a static or dynamic search for unused components. Although inertcode/data marks may be susceptible to attacks that check for thepresence of ineffective code, obfuscation techniques can be used to hidethe fact that certain code/data is inert.

4.1.1.2.1. Inert Code

As mentioned above, a code-section watermark can be embedded in theimmediate operands of inert instructions. The watermark is thus spreadover non-adjacent slots with intervening opcodes. FIG. 15A shows thegeneral form of an illustrative watermark holder, which consists of anopcode 1502, a memory address 1504, and an immediate operand 1506.

Referring to FIG. 15A, opcode 1502 may comprise any suitable value,including such common opcodes as MOV, LEA, ADD, SUB, AND, OR, and thelike. Since common opcodes typically have different variants (e.g., tohandle operands of different sizes, particularly on complex instructionset computers), it may be possible to store several bits of informationin the choice of opcodes. For instance, if there are eight ways torepresent an instruction or instruction sequence, then the choice of anyone representation contains three bits of information (i.e., log₂8).

Memory address 1504 can be stack-relative or absolute. A stack-relativeaddress will typically result from a macro such as the following:

#define Macro1( ) {int dummy = operand; ...}This type of macro usually translates into {mov [sp+x], operand} or {mov[bp−x], operand}. Care should be taken to prevent the compiler fromeliminating the macro code during optimization, and it may be desirableto avoid storing information in the address unless x is controllable orpredictable. In any event, since x is likely to be a small integer, justlike in many other naturally-occurring instructions, it will generallynot help much with registration.

In contrast, an absolute addresses will typically result from a macrosuch as the following:

#define Macro2( ) {static int dummy; dummy = operand;}Note that {static int dummy=operand;}would not result in any code, sinceif the operand is an integer, it will simply be stored in the datasection. If the macro's variables are defined as static variables, asshown above, then different instances of the macro will result in aunique locations in the data section corresponding to the macro'svariable (e.g., the “dummy” variable shown above). In fact, as shown inFIG. 15B, the absolute addresses can provide registration informationand identify the bit location that is being encoded. For example, 1600different addresses could identify 1600*mr positions, where m is thesize in bits of the payload, and r is the number of times the payload isreplicated. If the macros are inserted in the source code, the addresseswill typically not be known in advance, although they can be found aftercompilation if the operands are initially set to distinctive values(e.g., “50505050” in FIG. 15B).

Referring to FIG. 15B, in one embodiment immediate operands 1506 arechosen to be relatively small. For example, operands smaller than 2⁸could be used. This is possible since the addresses provide registrationand identification of the bit locations, and thus the operands need onlystore however much of the watermark payload is desired. For example, theoperands could contain a single bit of information (e.g., a 0 or 1). Ifthe operands are initially set to distinctive values to facilitatelocation of the addresses, these distinctive values can be replaced withwatermark-containing operands after compilation (e.g., 0x00000000 or0x00000001). This watermarking technique is described in more detailbelow, under the heading “Priming and Stamping.”

As with other inert code watermarks, marks inserted in the manner shownin FIG. 15B can be attacked by looking for code sequences that are neverused or that do not affect the program's proper execution. A way tocounter such attacks is to use opaque predicates on the memoryaddresses. However, opaque predicates may actually give away thelocations of the slots. One solution is to use opaque predicates onrandom ranges of data. If enough are used, they will cover most of theslots. Such predicates should preferably be kept out of inner loops, andit is desirable to have a relatively large variety of such predicates.Another solution is to use different opaque predicates on differentslots. It will be appreciated that even relatively lightweightpredicates can be used, as they may be hard to find automatically eventhough they may be relatively easy to spot manually.

It has been found that C-language macros such as those described inconnection with FIG. 15B may result in relatively unpredictablewatermark and/or container placement, as the compiler may, due tooptimizations, pull instructions from the preceding or succeeding codeinto the instructions generated by the macro. Moreover, the instructionsemitted by the compiler may vary depending on compile-time options. Itwill often be desirable to have a more predictable mechanism. Thus, inone embodiment the macros and/or inlined functions are encoded inassembly language to control the placement of content slots precisely.The macros and/or inlined functions can be inserted into the source codeby using appropriate compiler directives, or can be inserted directlyinto the assembly or machine code using a binary modification tool.While use of this technique facilitates precise watermark placement,since it uses assembly code, it has the disadvantage of generallyneeding to be coded separately for different platforms.

FIG. 16 shows examples of inlined functions for inserting assemblylanguage containers and/or marks into a program. For example, inlinedfunction 1602 is operable to insert a sequence of alternating ADD andXOR statements, the right-most operand of which is used to storewatermark information. This type of watermark container facilitatescollusion resistance, since if the code section is customized, thelocation of the watermark will generally differ indifferently-customized copies.

Referring back to FIG. 16, another illustrative container 1604 is shown.Container 1604 consists of a series of ADD statements, the right-mostoperand of which is used to store watermark information. Note thatcontainer 1604 might appear suspicious to an attacker inspecting thedisassembled code since the sequence of consecutive add instructions canbe compressed to a single add instruction, and a reasonable compilerwill make that substitution automatically. Container 1602 is not assuspicious or compressible since it contains a sequence of alternatingADD and XOR instructions. Thus, in a preferred embodiment, containerssimilar or identical to container 1602 are used; however, it will beappreciated that containers such as container 1604 could be used aswell.

4.1.1.2.2. Watermark Generation Language

An exemplary method for making watermark containers, such as thosedescribed above, and/or watermark registration patterns substantiallyunique without having to store a key is described below. A formallanguage is used to describe a possible set of parameterized null-effectsequences, based on some atomic primitives. For example, the sequencePUSH imm32/Readjust-SP is an example of an atomic parameterized NOP(imm32 being the parameter). In the simplest case the language is likeparentheses balancing, i.e., the primitives consist of components thatare paired into elements that do something and undo it like thePUSH/Readjust-SP example. In addition, we can use the fact that thecontents of the registers, memory, and/or stack can be interchanged aslong as the state of the system (e.g., computer) is unchanged in theend. Using such a language, a generator and a parser can be written. Thegenerator is operable to generate random instances that are unique foreach slot. Examples of null-effect sequences that might form part ofsuch a library include:

PUSH reg; POP reg; PUSH EAX; MOV EAX, value; POP EAX; PUSH imm32;Readjust-SP; LEA reg,[reg−x]; LEA reg,[reg+x]; XCHG reg1,reg2; XCHGreg2,reg1; AND reg, −1; OR reg, 0; NOPAdditional examples can be found in the Software Self-Defenseapplication and the '346 application. FIG. 17A shows an example of theuse of various null-effect primitives to create a unique null-effectpattern in watermarked program 1722.

4.1.1.2.3. Statistical Model of Watermark Language

To avoid detection, it is important for components that are added to aprogram to blend in with the rest of the program. Otherwise, an attackermight find the watermarks by creating statistical models of theexecutable code and looking for unusual code fragments. The presentinvention provides systems and methods for creating watermarks thatblend in with the program into which they are inserted.

One technique for creating stealthy watermarks and/or watermark holdersis to examine common compiler or programming idioms, and to model thewatermark code after such idioms. FIG. 17B illustrates a system forwatermarking a program using statistical analysis to select stealthymark holders and/or marks. Referring to FIG. 17B, a statistical analysismodule 1704 analyzes a program 1702 and generates one or morestatistical models 1706 of the programming idioms, data structures,and/or other programming constructs contained therein. Watermarkgenerator 1708 uses these models 1706 in connection with a library ofwatermark primitives 1710 (such as that described above in connectionwith FIG. 17A) to create stealthy marks for insertion into the programby watermark insertion engine 1714.

It will be appreciated that a number of variations could be made to theillustrative system shown in FIG. 17B. For example, while the embodimentdescribed above integrates statistical models 1706 into watermarkgeneration process 1708, in other embodiments statistical models 1706can be used by a separate watermark selection module 1712 to decidewhether to accept or reject the potential watermarks generated bygenerator 1708 (such as watermark 1722 in FIG. 17A). Similarly, whileFIG. 17B shows an embodiment in which watermarks are generatedautomatically from a library of atomic watermarking primitives 1710, itis also possible to simply choose and/or create the watermarks by hand,using the statistical models 1706 for guidance. Moreover, it should beappreciated that statistical modeling 1704 need not be performed on theprogram that is actually watermarked. Depending on the level ofsophistication of statistical modeling step 1704, it may be preferableto simply analyze one or more programs that are similar to the programthat is to be watermarked, and to use those statistical models to selectthe watermarks, thus avoiding the need to perform statistical modelingeach time a program is to be watermarked. Since an attacker willtypically not have a copy of an unwatermarked version of the watermarkedprogram, he will not be able to generate a statistical model on theunwatermarked version of the program anyway. Indeed, since thestatistical modeling performed by an attacker will typically be done onsimilar or related programs, it may be preferable to generatestatistical model 1706 from one or more such programs in order to avoidaccentuating other unusual characteristics of the program that is to bewatermarked (such as those characteristics that may result from theapplication of tamper resistance or obfuscation measures) by reinforcingthose unusual characteristics with watermarks that mimic theirappearance.

FIGS. 18A and 18B illustrate several statistical modeling techniquesthat may be used by a statistical modeling module such as that shown inFIG. 17B. Referring to FIG. 18A, one relatively simple modelingtechnique is to count the number of times certain opcodes are used. Asshown in FIG. 18A, the result might be a histogram showing the frequencywith which each opcode appears in the program. Watermark holders canthen be chosen that avoid using relatively uncommon opcodes. Forexample, it has been observed that while instructions like ADD, XOR, andMOV are relatively common in the code produced by standard compilers,instructions like MUL, ADC, and AAD are not.

Alternatively, or in addition, more sophisticated statistical modelingtechniques can be used to characterize common sequences of code, thusenabling the generation of even more stealthy code sequences. Forexample, in one embodiment Markov models are used to analyze the commoncode sequences and idioms that appear in “normal” compiled programs. Theinsights gained from this modeling process are then used to select thetypes of code sequences and customizations that are used for purposes ofwatermarking, the goal being to generate and use code sequences thatblend naturally into the rest of the program, and are thus resistant tostatistical analysis.

A simple statistical modeling technique is shown in FIG. 18B. A graph isformed in which each node 1820 corresponds to an opcode 1822. The edges1824 that connect the nodes represent the occurrence of a sequence oftwo opcodes. Each edge has an associated probability 1826 thatrepresents the likelihood that the given two-opcode sequence will occur(or the relative likelihood that the next opcode in the sequence willoccur, given the occurrence of the first opcode). Thus the graph iseffectively a probabilistic state diagram in which each node representsa state, and each edge represents the probability of a transitionbetween the states that it connects.

As shown in FIG. 18B, a simple code fragment 1821 might generatestatistical model 1823. Model 1823 shows the probability that eachopcode will occur, given the occurrence of another opcode. In the shortcode sample shown in FIG. 18B, the MOV opcode is followed once by theXOR opcode, once by the ADD opcode, and twice by another MOV opcode.Thus, given a MOV opcode, the probability that the next opcode will beanother MOV is 50%, the probability that the next opcode will be an ADDis 25%, and the probability that the next opcode will be an XOR is also25%. The probability of each of the other edges in the graph isgenerated in a similar fashion. Note that in this example the edgesrepresent relative probabilities, and thus it may be desirable to assigneach node a probability (obtained from a histogram such as that shown inFIG. 18A) that indicates the likelihood that a given state will occur.This probability can be multiplied by the relative path probability toobtain the absolute probability that the given path will occur in theprogram.

The effectiveness of the modeling technique can be enhanced by usingsomething more detailed than an opcode for each node—for example,something like “AND with a 32-bit immediate operand, and 8-bitdisplacement address.” Thus, in one preferred embodiment, the nodes ofthe Markov model consist of “instruction, operand type, register use”,with each of these nodes having associated distributions of immediateoperands, displacement addresses, etc. Alternatively, or in addition,these distributions can be associated with larger groups of nodes to getstatistically better results. Thus, for example, the probabilitydistribution of the jump location for conditional jumps might be X; theprobability distribution of the immediate operands for logicaloperations might be Y, and so forth. The transition probabilities canthen be determined empirically for a large piece of code. This caninherently model compiler idioms and provide a way to quantitatively sayhow likely it is that a sample piece of code was generated by acompiler. Of course, like any Markov model of a non-Markovian process, agreat deal of potentially relevant (and/or important) information isthrown out.

Thus, it will be appreciated that statistical modeling can be done atdifferent levels of complexity, depending on available resources, thelevel of statistical analysis that is expected from an attacker, andother factors. Moreover, it should be appreciated that there are avariety of sequence modeling techniques, and that any suitable one couldbe used without departing from the principles of the present invention,including Markov models such as those described above and variationsthereof.

4.1.2. Replace or modify existing components

Watermarks can also be inserted into components that already exist inthe program, thus obviating the need to insert and disguise newwatermark containers.

4.1.2.1. Replacing Dead Code

Many common compilers align code on 16-byte boundaries. When functionsdo not align, the compiler typically pads up to the nearest boundarywith RET or INT3 instructions that are never executed. For example, theMicrosoft Visual C++ compiler often generates a lot of these paddedregions, especially for functions and methods that consist of littlemore than a call to another function or method. These padded areas andunreachable blocks make good places to place watermarking bits using abinary code modification tool. The watermarks placed in these locationscan take a variety of forms. For example, one technique is to insertarbitrary code. Another is to store a jump table. Since the compileroften stores jump tables after a RET instruction, this would berelatively stealthy and attack-resistant, since if an attacker removesall code or jump tables inserted after RET instructions until the next16-byte boundary, the attacker will often remove some valid code or jumptables as well.

4.1.2.2. Alternate Instruction Encodings

Marks can also be embedded by making peephole changes to code that isexecuted at runtime. For example, scale bits can be manipulated,instructions or instruction sequences can be replaced with theirequivalents, registers can be re-allocated, and so forth. Use of suchtechniques will often be advantageous in that they generally do notinvolve the addition of new resources or expansion of the program.

4.1.2.2.1. Manipulating the Instruction Format

One effective watermarking technique is to make use of redundant orcomplementary components that are peculiar to the instruction format ofthe platform on which the watermarked software is run. These redundantinstruction components can be used to generate instructions that havethe same effect on the program's operation, but which appear slightlydifferent in the program's binary image. The Intel 80×86 instruction setpresents many such opportunities for watermark insertion, due to thevariety of idiosyncratic formatting options that have resulted from theprocessor's complex evolution, and the variety of design decisions andbackwards compatibility requirements that this evolution entailed. Forpurposes of illustration, several examples of the watermarkingpossibilities offered by the Intel 80×86 instruction format aredescribed below; however, it will be appreciated that there a widevariety of similar or equivalent ways to insert watermarks by exploitingthe peculiarities of the Intel instruction format and/or the instructionformats of other platforms, any of which could be used without departingfrom the principles of the present invention.

To facilitate the discussion that follows, FIG. 19 shows the generalformat of an instruction on the Intel 80×86 platform. Additionalinformation on the Intel instruction set can be found in the IntelArchitecture Software Developers Manual, Chapter 36, which is herebyincorporated by reference. Information about instruction sets for otherplatforms can be found, for example, in “PowerPC Microprocessor Family:The Programming Environments for 32-bit Microprocessors” (Motorola,MPCFPE32B/AD); “The SPARC Architecture Manual, Version 9” (Sparc Int'l,1999); Sites and Witek, “Alpha AXP Architecture Reference Manual” 2nded. (Digital Press, 1995); Kane, “MIPS R2000 RISC Architecture”(Prentice Hall, 1987); and “SA-110 (StrongARM) Microprocessor TechnicalReference Manual” (Intel Corp.).

4.1.2.2.1.1. Instruction Prefix Bits

As shown in FIG. 19, each opcode can be preceded by any of four classesof optional instruction prefixes, which can be used to overrideaddressing segments, to change from 32-bit to 16-bit operations, and tospecify repetitive operations for string-based instructions. For manyopcodes these prefixes are irrelevant, but can nevertheless be insertedinto the instruction stream without adverse effect. For example, manyinstructions do not do any addressing, but can be given anaddressing-mode prefix. Thus, watermarking information can be insertedinto a program by manipulating the prefix bits of instructions for whichthose bits do not matter. Such manipulations will typically incurnegligible computational overhead, and will be relatively stealthy sincethey will not show up as keywords when the code is disassembled.

One such prefix is the bit pattern 001xx110, where xx are two bits thatcan be varied to select between segment override prefixes CS, DS, ES,and SS. If this prefix is added to an instruction for which the prefixis irrelevant—such as a NOP—the xx bits can be set to any desired valuewithout affecting the program's operation. Thus, watermarks can be addedto the program by, e.g., adding instructions for which the prefix bitsdo not matter and embedding a watermark in the prefix bits, and/or bylooking for existing occurrences of this type of instruction and addingor changing the prefix bits as desired. The marks can be found bymaintaining a list of the locations at which the prefix manipulationswere performed, or by using other suitable registration techniques.

4.1.2.2.1.2. Direction Bits

Direction bits provide another opportunity to take advantage of theinstruction formatting idiosyncrasies of the Intel 80×86 architecture.The opcodes of many two-operand instructions on the Intel 80×86 platforminclude a bit—the direction bit—that indicates which operand is thesource and which is the destination. This may be useful, for example, ifone of the operands is a register and the other operand is a memorylocation. However, if both operands are registers, for example, thedirection bit is essentially redundant, since the direction bit can beset to an arbitrary value and the order of the registers in the machinelanguage representation of the instruction can be flipped to preservethe original meaning of the code.

FIG. 20 illustrates how watermarking information can be embedded in thedirection bits of certain instructions. Referring to FIG. 20, originalpseudo-code sequence 2002 is transformed into watermarked pseudo-codesequence 2004 by manipulating the direction bit of certain two-operandinstructions in which both operands are registers. Specifically, thedirection bits are used to form a relatively long, error-correctingstring that contains all or part of the watermark payload. The order ofthe registers is switched, as appropriate, to preserve the originalfunction of the program. For example, in original code sequence 2002,instruction 2006 added the values contained in the EAX and EBX registersand stored the result in the EAX register. In the machine coderepresentation of that instruction 2007 a, the direction bit 2005 wasoriginally set to 0, and the code for the EBX register was listed first,followed by the code for the EAX register. In watermarked code sequence2004, the direction bit has been changed to 1, and the codes for the EAXand EBX registers have been swapped in the machine languagerepresentation of the instruction 2007 b order to maintain equivalencebetween original instruction 2006 a and watermarked instruction 2006 b.Thus, both instructions 2006 a and 2006 b add EAX to EBX and store theresult in EAX, but the machine code implementations differ. Successivebits of the watermark can be encoded in successive instructions of thistype (e.g. ADD reg1, reg2). To retrieve the watermark, the directionbits of instructions of this type can be placed in a sequence, and thewatermark can be recovered by examining the resulting bit stream. If thewatermark is encoded as an error-correcting string in a sparse space, itwill be recoverable even if part of the string is missing or if spuriousbits are added. The direction bits of different instruction types can beused to hold different watermarks (or different portions thereof). Forexample, a separate watermark could be stored in the string of directionbits associated with ADD instructions, while another watermark could bestored in the direction bits of XOR instructions. A normal program willtypically contain numerous instructions of this type, and thus thedirection bits provide a relatively high-capacity channel for thestorage of watermark information. To improve stealth, it may bedesirable to examine the use of direction bits by common compilers andto use direction bits in a similar manner when watermarking the code.Additional information on the encoding of the direction bit can be foundin the “Intel Architecture Software Developer's Manual, Volume 2:Instruction Set Reference Manual,” Appendix B, p. B-5, Intel OrderNumber 243191 (1999).

4.1.2.2.1.3. Scale Bits

Another watermarking technique takes advantage of useless bits in theSIB (scale-index-base) addressing mode found in Intel 80486 and laterprocessors. In SIB addressing mode, if Index is the bit pattern 100, theSS bits are ignored. Thus, the SS bits can be used to store watermarkinformation. The watermark information can be detected using an externaldatabase of locations and/or content. Simple disassembly will be able tolocate the SS bits, which may obviate the registration issue. The storeddatabase of content can then be used to link them up in the correctorder.

This approach is advantageous in that no instructions need to be addedto the program, as there will typically be plenty of such instructionsalready in the code. Moreover, since additional instructions are notbeing added, and the added bits are ignored, performance is generallynot degraded. In addition, the watermark is quite stealthy since it doesnot disassemble into anything suspicious looking, and can thus be easilyoverlooked by an attacker. The primary disadvantage is that if anattacker discovers the hiding mechanism, it is relatively simple toremove the entire watermark. That is, this technique is prone togeneralization.

4.1.2.2.2. Equivalent Forms of Instructions

Many instructions and instruction sequences can be expressed in any ofseveral effectively equivalent forms. Thus, watermarking information canbe stored in the form that is chosen. For example, if there are two waysto represent an instruction, the choice can be used to contain a bit ofwatermark information. For example, a “mov eax, imm8” instruction can bereplaced with a “mov eax, imm32” instruction, as the second instructionwill be able to handle whatever value was specified by “imm8.” One ofordinary skill in the art will appreciate that there are numerous otherexamples of such equivalent instructions and instruction sequences, someof which are set forth in the Software Self-Defense application, whichwas previously incorporated by reference herein. It will also beappreciated that this technique is related to the permutation techniquesdescribed below in connection with FIGS. 21A and 21B. Moreover, sincethis technique can make use of instructions that actually form part ofthe program's execution, it will generally be difficult for an attackerto remove a mark embedded in this manner.

4.1.2.3. Watermarked Booleans

Watermarking may advantageously be combined with any of several programand data obfuscation techniques, as described in the '346 applicationand in the Software Self-Defense application, in order to achievestronger obfuscation and to make it more difficult to remove or modifythe watermark without impairing the execution of the program. The kernelof the idea is to include parts of the watermark in computations of theprogram in such a way that changes to the watermark by an attacker willalmost certainly disrupt the computation, but without undulyconstraining or complicating the watermarking process. Any redundantrepresentation of watermarks may be used, and the program variables maybe of any type. However, a preferred embodiment uses boolean programvariables to simplify the implementation.

For ease of explanation, a simplified scheme will first be described.The basic idea is to tie variables in the program to a watermark in sucha way that random changes in the watermark are highly likely to causethe program to malfunction by misinterpreting the variables.

In an over-simplified scheme, the watermark can be stored as a constantin a known place. If a code rearrangement tool moves it, it can be foundrelatively easily, as described in more detail below. In the program, anumber of boolean variables bi are chosen corresponding to the number ofbits in the watermark, and each bi is associated with a bit in thewatermark w[i], so that the “correct” value of the variable is theexclusive-or of its stored value and the watermark bit, i.e., bi+w[i](where “+” is equivalent to XOR for one bit variables). Where theoriginal program uses bi in an expression, it is replaced with bi+w[i],and where the original program has an assignment bi=e, it is replacedwith bi=e+w[i]. Thus the program will still calculate its originalresult, whatever that was, but some of the boolean variables will becomplemented as determined by the watermark. The result is a “hintedprogram” that can be watermarked with any desired watermark by settingW.

Note that this transformation of the program is obfuscating: itincreases the apparent number of program variables to include thewatermark W, and adds complexity to each computation that sets or usesthe bi. However, the weakness of this over-simplified scheme is that theprogram will produce equivalent results regardless of what value thewatermark has. Thus, an attacker could zero out the watermark constant,or replace it with any value, without affecting the operation of theprogram.

To protect against modification of the watermark, some form ofredundancy can be used. For example, in a repetition code, for an N-bitwatermark, 2*N bits can be stored. A simple code would just store thetwo repetitions in adjacent positions (or just store two copies of thewatermark), but then it would be easy for an attacker to discover thisrelationship, and modify both consistently.

One way to make the relationship more obscure, while still making iteasy to apply watermarks, is to pick two (obfuscation-time) functions fand g over 1 . . . N with disjoint ranges whose union is 1 . . . 2N,plus an N-bit obfuscation-time mask M. To apply the watermark, setW[f(i)] to w[i] and W[g(i)] to M(i)+w[i]. Where the original programuses bi in an expression, replace it with bi+W[f(i)]. Where the originalprogram has an assignment bi=e, replace it with bi=e+W[g(i)]+M(i). Aslong as W is set as specified, the program will still calculate itsoriginal result, although some of the boolean variables will becomplemented, as determined by the watermark of an individual instance.However, if an attacker changes a single bit in W, it will cause aboolean variable to be inconsistently set and read. If the variableaffected the original computation, the computation will go wrong. (Evennumbers of bits can be changed safely only if they maintain theinvariant W[f(i)]=W[g(i)]+M(i).) The difference between the watermarkerand the attacker is that the former knows f, g, and M, which appearnowhere in the program, and would be difficult to deduce, even if allother aspects of the scheme were understood.

It should be appreciated that the “variables” need not be datavariables, but could also (or instead) encompass other characteristicsof the program. For example, the logic at the end of basic blocks can beused to encode information (e.g., the sequence je A; jmp B; isequivalent to jne B; jmp A;, and thus information can be encoded in thechoice of which of these sequences to use in a particular block).

An attacker who knows that precisely this watermarking algorithm hasbeen used could defeat it by statically examining the code, and for eachbi, observing the two indexes in W that are consistently associated withit. More realistically, the attacker can make a table of references toboolean variables that are near references to positions in W, and figureout the pairing from there. Although such an attack, if successful,would allow bit-by-bit modification of the watermark, it would typicallyhave a significant cost in examining code. To make this attack moredifficult, positions in W can be associated with other boolean variablesin dead code or in don't-care tests.

Although this is not particularly robust against an attack thatcomplements all of W, such an attack would typically allow the attackerto insert only one other watermark, and it can be detected by insertingan additional redundant bit in W.

A number of variations can be made to this technique. For example:

-   Associate more than one variable with each bit of the watermark.-   When modifying the original program, quasi-randomly choose between    W[f(i)] and W[g(i)]+M(i) both for loading and for storing, thus    making the pattern harder to recognize.-   Use more than 2N bits for W, and a stronger code than a repetition    code, as discussed elsewhere in this disclosure.-   Vary the pattern of code substitutions. E.g., instead of    bi=e+W[g(i)]+M(i), sometimes use:

if W[g(i)]+M(i) then bi = e else bi = ~eand/or:

if e then bi = W[g(i)]+M(i) else bi = W[g(i)] +~M(i)

If the optimizer rearranges this code, so much the more obscure.

Redundancy in W can be used in conjunction with redundancy in theprogram variables, using techniques similar to those described in the'346 application. For example, a boolean value b can be represented by acollection of boolean variables, e.g., c1 . . . ck, and bits in thewatermark can be used to specify the interpretation table (truthfunction) that tells which value each combination of the values of c1 .. . ck represents. If approximately half the combinations representtrue, and half false, that still leaves 2^(k) choose 2^(k−1)combinations available, enough to absorb more than 2^(k−1) bits ofwatermark. Virtually any 2² ^(k−1) combinations can be chosen atobfuscation time and assigned arbitrarily to combinations of thewatermark bits.

c1 . . . ck can be converted to a truth value whenever b is used in acomputation and boolean values can be expanded again when they arestored to b. Alternatively, boolean computations can be carried outusing multi-bit values; bits from the watermark can be used to selectthe representation to be used for each intermediate result, just asother bits are used to select the representations of the explicitprogram variables. In a preferred embodiment, each intermediate resultis associated with a distinct part of the watermark's redundantrepresentation.

Since there will be multiple ways to represent each truth value, therewill be multiple possible “truth tables” for the boolean operations.These tables can be fixed at obfuscation time, or selected dynamically,using still more bits of the watermark's representation.

As an example, consider the case k=2. There are 6 ways (i.e., 4 choose2) of allocating half the representations to true:

-   -   {00, 01}, {00, 10}, {00, 11}, {01, 10}, {01, 11}, {10, 11}

Arbitrarily pick and number four (2² ^(k−1) ) of them; for example:

-   -   0: {01, 11}, 1: {00, 01}, 2: {01, 10}, 3: {00, 11}

There are 2⁴ valid four-entry two-bit tables for each of the sixteencombinations of input and output representations. For each negation inthe program, we can choose one of its tables at obfuscation-time, andget the result by indexing this particular table by the two bits of theargument. There is no reason to store the (up to) sixteen tablescontiguously; we could scatter them according to an allocation schemethat is only known at obfuscation time.

Alternatively, we could calculate the first bit and the second bit ofthe result in two separate computations. This would require twice asmany four-entry one-bit tables. We could completely compute one beforestarting on the other, making the linkage between the two bits of theresult harder to detect (particularly after an optimizer has gone overthe code). Part of the (obfuscation-time) invariant would be thatcorresponding tables would be used for the two halves of each operation.

Correspondingly, for binary boolean operations, there are 2¹⁶ possiblevalid sixteen-entry two-bit tables for each of the 64 (4×4×4)combinations of input and output representations. There is no need tostore all of them. We can choose any “sufficiently large” subset atobfuscation time—that is, enough tables so that the number of times anyone of them is used is small enough to make the attacker's taskdifficult. We need not store any that the program doesn't use.

Note that since we are dealing with boolean values, we don't have to usearithmetic to subscript into the tables. We can scatter the individualelements according to a scheme known at obfuscation time, and useconditionals to select the address.

There is a potential attack on the schemes as described. The weaknesscomes at each point in the program where an actual boolean bi is needed(e.g., to control a conditional or loop). The attacker can inspect thecode that converts ci1, . . . , cik to bi. The code will unambiguouslyidentify the equivalence sets representing true and false, and willreveal both the bits in W that are used to control the conversion andthe locations of the associated bits ci1, . . . , cik. All of thisinformation combined might provide leverage towards breaking the scheme.

A counter-attack is to chain the use of the bits in W, so that each W[i]contributes to determining the representation of more than one variable,and thus requiring a consistent set of changes to be made to the wholechain rather than to just the bits determining the coding of a singleboolean. Although this generally does not complicate an attacker'sanalysis, it does impede an attacker's attempt to use the analysis ofone variable to change the watermark in the associated bits.

Another counter-attack is to use a separately-determined representationfor each such boolean. I.e., if the value is in a variable, first assignit to a distinct multi-bit temporary.

Note that converting from a regular boolean to a multi-bit version isnot very revealing. Since we can, at obfuscation time, choose to use anyone of 2^(k) valid conversion tables, the code will reveal only oneelement in each equivalence set, rather than all of them. Again, if weare assigning one variable to another, we can pass it through a uniquemulti-bit temporary on the way.

Although these techniques could be readily applied by hand, in apreferred embodiment a class called WatermarkedBool is built thatoverrides all the boolean operations with their watermarked versions.This can be inlined to yield more efficient—and more obscure—objectcode.

4.1.3. Permutations

Marks can also be inserted by modifying program control structures. Forexample, code blocks can be duplicated, object files can be rearrangedduring linking, or other similar techniques can be used. Instances ofthe program will look different, and these difference can be used forpurposes of identification. There are a wide variety of softwarecomponents, structures, and operations that lend themselves topermutation, including without limitation, program basic blocks, theprogram linking order, sparse jump table indices, components in othertables, the order of null-effect instruction sequences, and the like.More examples are described in the Software Self-Defense Application andthe '346 application, which were previously incorporated by reference.

A general technique for embedding watermark information usingpermutations will first be described, followed by several examples ofhow this technique can be applied to various program components. Asshown in FIG. 21A, a sequence of n program structures 2102 (e.g., basicblocks, jump table indices, null-effect sequences, etc.) can be permutedin n! different ways. In the example shown in FIG. 21A, n is equal to 3,and there are thus 6—i.e., 3!=3*2*1—different permutations of structures2102. The program creator or distributor can then produce n! instancesof a program that each contain a different one of the permutations. Thepermutations can then be mapped to a unique watermark 2104, and themapping can be stored in database 2106. As shown in FIG. 21B, when acopy of the program is retrieved, the program creator extracts thewatermark by observing which of the permutations has been used (2120),using the permutation to index database 2106 (2122), and retrieving thewatermark 2104 contained therein (2124).

It will be appreciated that the technique shown in FIGS. 21A and 21B canbe easily extended to more complex situations. For example, the numberpermutations might be chosen such that it is much larger than the numberof assigned watermarks, thus making it more difficult for an attacker toforge a valid mark by simply making a permutation. This is essentiallyanother variation of the sparse space encoding techniques describedabove. In such an embodiment, the watermark detector could be operableto determine the closest match to a detected permutation, thus providinga degree of fault-tolerance. It will be appreciated that othermodifications could be made to the basic scheme set forth in FIGS. 21Aand 21B without departing from the principles of the present invention.

4.1.3.1. Basic Block Permutation

Since a major attack is based on reorganizing basic blocks, a solutionis to factor out the linear layout of the basic blocks and look at thehigher-level control-flow graph. The static flow graph consists of basicblocks (as vertices) connected by jumps and/or statically-known calls. Abinary editor can compute such a graph. The graph can be used in atleast two ways: as a watermark itself and/or as a registration mark.Both of these are independent of the linear layout of the basic blocks,and are therefore robust against basic-block reorganization byattackers.

Techniques for adjusting the static flow graph include:

-   -   Refining the graph by splitting basic blocks or by introducing        new basic blocks that are either not executed at runtime or have        no effect. This is preferably done in a way that does not        significantly degrade performance. See the Software Self-Defense        application.    -   Replicating some basic blocks in the image and, for jumps to        such a block, choose the copy to jump to based on bit(s) in the        watermark.

Of course, an attacker can use the same techniques to change the staticflow graph—e.g., splitting, introducing, or replicating basicblocks—although this will generally require a relatively sophisticatedbinary editor. Another problem with this approach is that changes to theflow graph are relatively error-prone, and might result in poordebugging capabilities.

In one embodiment the static flow graph serves as a registration mark(the carrier signal) and the watermark is applied on top of that. Thus,reorganizing the basic blocks will not change the watermark per se.Equivalently, the basic-block layout can be normalized before readingthe watermark. The problem is then reduced to recording somewatermarking bit(s) in each basic block. This could be done using one ofthe schemes listed above. An attacker might still attempt to split,introduce, or replicate basic blocks; however, in this case it mightstill be possible to map the resulting static flow graph to the originalgraph (using, e.g., error-correcting techniques), since the resultinggraph will generally be a refinement of the original graph.

4.1.3.2. Register Reallocation

As mentioned above, register allocations are an example of a programcomponent that can be permuted. Suppose a register R is live for acertain range of instructions and another register S is free in thatrange. In general, R may be replaced by S in that range. A register cantypically be considered free at a point V in the program if the registeris written at some point, W, after V; the register is not read between Vand W; and the control does not flow out between V and W. Theseconditions are sufficient but not necessary, though they may provide agood first-order approximation of a more flexible rule. See, e.g., Waiteand Goos, Compiler Construction (Springer-Verlag, 1984).

In a preferred embodiment, modifications are used that are provablycorrect, do not require a lot of analysis to make, and that cannot beeasily reversed. The last feature is important in protecting this schemeagainst attackers who know about the general technique. Simpleinstructions can often be inserted that make the reversal hard. Forexample, the instruction “mov unused_address, EAX” can be inserted togive the impression that EAX is in use at that point. Additionalmodification techniques are described in the Software Self Defenseapplication.

4.1.3.3. Watermarking Compiler

Ordinary compilers make many decisions in the course of transforming asource program to machine code. Many of these decisions are made toproduce better code (e.g., faster code, or code that uses less memory orfewer registers, etc.). For example, a compiler might select certaininstruction sequences that execute more quickly or might allocateregisters to minimize spill code. Other decisions that a compiler mightmake are somewhat arbitrary, such as picking an order in which to placecode fragments (object modules) in an executable image. Thus, acompiler's decisions describe a lattice of possible programs, some ofwhich are strictly better than others (e.g., faster and use less memory,etc.), and others that are not readily comparable (e.g., faster but usemore memory).

A watermarking compiler can make some of its decisions in order torepresent bits of the watermark, rather than purely for performancereasons. Thus the watermark is encoded in fundamental properties of theresulting object code, including but not limited to: instructionselection, spill code placement, register allocation, basic blockordering, procedure linkages (present or absent due to inlining oroutlining), data representations, control structure, etc. Compiling thesame program with a different watermark will result in different(possibly radically different) byte-code or machine-code. Watermarkingduring compilation has the advantage (over binary or byte-codewatermarking) that the entire program structure is available in aconvenient form for manipulation to structure a watermark into theresulting code.

4.2. Detection

Extracting a watermark from a piece of software is essentially theinverse of the process of embedding the watermark. The extractionprocess typically involves detecting the presence of the watermark,determining how the marks are embedded, retrieving the marks (andpossibly noise), and relaying that information to the watermark decoder.

In one embodiment, authorized retrieval of a watermark makes use ofsecret information not known to attackers. These secrets can be used forboth extraction and decoding. Extraction techniques can be categorizedgenerally based on the type of secret information that is used, andwhere it is used. Two broad categories of extraction techniques are (i)embedding-based identification and (ii) encoding-based identification.

Embedding-based identification uses secret information from theembedding step to locate marks with reasonable accuracy. Thisinformation may take a variety of forms, including:

-   -   Secret Information Independent of the Watermarked Program: Here,        the secret is typically a secret key or other mechanism that        makes it computationally infeasible for an attacker to recover        the watermark. The secret information could also be a parameter        used in generating the marks; e.g., the sequence of opcodes when        the payload is stored in immediate operands, the locations of        memory addresses in instructions that are used to store the        marks, and so forth. Relying on this type of secret is usually        prone to generalization attacks and/or information leaks. The        resistance to generalization attacks for such techniques depends        on the degree of parameterization. The higher this degree, the        less identifiable the marks for attackers.    -   Secret Information Specific to the Watermarked Program: The        location of marks, the context surrounding the marks, and the        like can be used to find otherwise unidentifiable marks that are        resistant to generalization attacks. A disadvantage is that this        approach generally entails storing secrets specific to each        program in a secure database, the extraction process comparing        the program with the secret stored for that program.

In encoding-based identification, the extraction process typicallyreturns marks along with often significant amounts of noise using, e.g.,publicly-known (or not-so-secret) placement information. It is then upto the decoding step to filter the information provided by theextraction step to retrieve the payload.

The first step in retrieving watermarks is to locate them. To that end,some container types provide registration. For example, the code-sectionwatermark described in connection with FIG. 16 can be located bysearching for the sequence of opcodes: mov, add, xor, . . . , withsuitable gaps to account for the variable-size content slots. Thesequence is large enough that it does not occur otherwise in theexecutables that were examined in connection with the work set forthherein.

In addition, some content types provide registration. For example,signature-carrying content also provides registration. A pointer can beslid over the watermarked file byte-by-byte. For each position of thepointer, the data can be interpreted as the watermark; however, thepayload is accepted only if the signature is consistent with the salt.This technique was illustrated in connection with FIGS. 10 and 13.

A general strategy to locate watermarks is to iterate over all containertypes. If a container type provides registration, the registrationprovided by the content, if any, can be ignored or used to filter outfalse hits. If the container does not provide registration, it shouldhold only those content types that do. In this case, the detectoriterates over the potential content types for the given container type,and for each content type, uses the content-specific registrationmechanism to detect the marks.

If the registration involves searching for a fixed pattern, we call itfixed registration, otherwise we call it variable registration. Atretrieval, fixed registration involves pattern matching while variableregistration involves applying a generic boolean function to a block ofdata. In the examples above, the code-section container provides fixedregistration and the signature-carrying content provides variableregistration. However, some content types may provide fixed registrationas well. Fixed registration is simpler to implement and search for, butis more prone to correlation and generalization attacks.

A false watermark might occur because of accidental registration ormalicious corruption. Accidental registration occurs when theregistration is present naturally in the unprimed program. Maliciouscorruption occurs when an attacker discovers a watermark and is able toforge a valid watermark with different content.

The vulnerability of a registration technique to accidental registrationmay be measured as the probability p that a random block of data willpass it. For signature-carrying content with an s-bit signature, p is½^(s) (the probability that a decrypted s-bit value will match anothers-bit value). If a file contains n bytes of random data, the expectednumber of accidental matches in the file is np. For a one megabyte fileand a 32-bit signature, this number is ½¹². Even so, both fixed andvariable registration can be tested against a stamped executable todetect accidental matches in advance. In both cases, the registrationcan be tuned to avoid them; e.g., the key used to encrypt the signaturecan be changed.

The presence of many watermarks in a file can be used to filter outfalse watermarks. The retrieval procedure can report the payload, thecontainer type, the content type, and the count of copies found. Ifdifferent payloads are found, the payloads with relatively small countsare likely to be false and can be rejected. Another criterion is thenumber of different container types bearing the same payload. Whenattackers discover one container type, they are more likely to discoverall instances of that container type; so payloads appearing in only asmall number of container types are more likely to be maliciouslycorrupted.

Yet another approach to locating watermarks is to keep a list of thelocations at which the watermarks are stored. The detector locates themarks by consulting the list. This is a kind of “original-based”watermarking, in that information about the original program, or atleast the watermarked parts of it, is used for reading the watermark. Anadvantage of this technique is that it does not require the addition ofexplicit registration information to the program.

FIG. 22 illustrates the use of this technique. Referring to FIG. 22, aprogram 2202 is customized, resulting in many different versions 2204.Program versions 2204 may differ in a variety of ways, as describedelsewhere herein. In particular, the program versions will typicallyreserve a different location or set of locations at which to store aninstance-specific watermark. When each version 2204 is created, a list2206 is also created indicating where the watermark is (or will be)stored. For example, the list might include the address of the watermarkand the 8-bytes preceding that location (the “prefix”) and the 8-bytesfollowing that location (the “suffix”), although it will be appreciatedthat values other than 8 bytes could be used. The list might alsocontain information on how to combine the watermark fragments found atthose locations and/or other contextual information about theselocations to help in retrieving the watermark even if the addressing hasbeen modified. The list 2206 for each version is saved in a database2208.

Copies of each version are then distributed to consumers or other users.Each copy is individually watermarked with a unique value, or withunique information regarding the details of the transaction. List 2206for each version of the program is also preferably associated withanother list that contains the values of the watermarks that wereactually inserted at the specified locations in each instance 2210 ofthat version 2204 of program 2202.

In one embodiment, a set of uniquely watermarked instances 2210 arecreated before the program is distributed. When a user purchases a copyof the program, the user is provided with a randomly selected instancefrom a randomly-selected version of the program. The identity of theinstance (e.g., the value of its watermark) is maintained in a list,together with information regarding the consumer's identity and/or otherdetails about the transaction. In other embodiments, the programinstance is uniquely marked at the time of distribution. For example,upon receiving a request for a copy of the program, an instance-specificwatermark can be inserted into a copy of a randomly-selected version ofthe program, the instance-specific watermark containing encodedinformation about the purchaser and/or the details of the transaction.

When a watermark needs to be recovered—for example, when it isdiscovered that a copy of the program is being distributed without thecreator's permission—the suspect program is matched, in turn, againsteach of the lists in the database to determine where the stamped primersare located. Once a matching list is found, the watermark is extractedfrom the stamped primers, and the purchaser of that copy of the programis identified.

A method for comparing the suspect binary to the lists in oneillustrative embodiment of the present invention is shown in FIG. 23.Referring to FIG. 23, the lists are searched successively until theappropriate list is located. As shown in FIG. 23, starting with thefirst list, the program is checked for the eight-byte prefix of thefirst entry in the list. This can be accomplished by looking at theaddress specified in the list, or simply by performing a string searchon the file. If the eight-byte prefix is found (i.e., a “yes” exit fromblock 2308) and the eight-byte suffix is found (i.e., a “yes” exit fromblock 2309), then the mark is extracted from the specified location, anda search is performed for the next eight-byte prefix in the list. If, onthe other hand, the appropriate eight-byte prefix (or eight-byte suffix)is not found (i.e., a “no” exit from block 2308 or block 2309), then adetermination is made as to whether to move on to the next list in thedatabase, or to continue checking for the mark in the current list(block 2312). For example, a counter can be maintained indicating thenumber of failed searches for a prefix or suffix in the list underconsideration. If the failure count exceeds a certain level, processingcan move on to the next list in the database (i.e., a “yes” exit fromblock 2312). Otherwise, processing of the current list continues. Toavoid discarding a list for which a large number of matches have beenobtained, the failure counter might be decremented each time asuccessful prefix/suffix match is obtained. Although FIG. 23 illustratesone scheme for searching the database of lists, it will be appreciatedthat there are a wide variety of ways to search the list database, anysuitable one of which could be used without departing from theprinciples of the present invention. Once each of the individual markshave been extracted, they can be assembled and decoded if necessary toobtain the original watermark payload, which may, for example, identifythe particular instance of the program and/or provide other information.If there were a million lists in the database, it would, on average, benecessary to examine approximately 500,000 lists to find a match.However, it will generally be safe to discard most lists after only afew comparisons, since it will typically be unlikely that more than fewconsecutive prefixes and suffixes found in an incorrect list will occurin the program that is being examined. Thus, it will typically bepossible to search even a million lists fairly rapidly. To speed up thesearch time, all of the 8-byte patterns in the suspect program can beidentified and indexed, thus making it very quick to search for anyparticular one.

The search technique described above will work best on programs that arelargely undamaged. If a damaged program or program fragment isencountered, it may be desirable to search the list database in aslightly different manner. For example, if only a fragment of theprogram is recovered, the database can be searched for the list thatincludes the largest fraction of matching prefix and suffix strings.This can be done by searching the program fragment for each entry ofeach list (which could be relatively time-consuming if there are manylists) and choosing the list for which the most matches are found.

Another approach is to build an additional data structure for each list,the data structure containing the fifty least-frequent prefix and suffixstrings in the list (or simply fifty randomly-chosen prefix/suffixstrings). Only a few primer lists would have non-negligible scores. Each8-byte primer prefix/suffix pattern should be more or less random, andthus has almost no chance of appearing in the binary. If they were trulyrandom, the odds would be about one in 2⁴³ (10¹³). Although it will beunderstood that they will typically not actually be random, as theyrepresent instructions, addresses, and constants that are notparticularly random, still, experiments suggest that the vast majorityof 8-byte patterns in any particular executable appear only once, andthat those patterns do not appear in other executables.

Thus, for example, if all the primer lists that have three or morematches are selected (five matches would be expected to occur in 10% ofthe suspect binary), it is unlikely that there will be very many—mostlikely under 1000. The same matching can then be performed against thefull set of prefix/suffix patterns in those, e.g., 1000 primer lists.Having found the primer locations, we can then extract the watermarkfrom the stamped primers and decode it—which may still be possible ifthe mark is encoded using redundancy and other error correctiontechniques. Or, if the mark itself were stored in the list.Identification of the version, and the extent to which the recoveredwatermarked fragments matched the stored mark, would allow a confidenceinterval to be constructed indicating the level of certainty that therecovered instance actually corresponds to the list stored in thedatabase. If the database were maintained by a neutral, trusted thirdparty (i.e., by an entity other than the program's owner), evidence ofthe similarity between the recovered program and the original instancecould be used in identifying and prosecuting the person or entityresponsible for distributing or modifying the program without theowner's permission.

For this two-pass statistical analysis, it is not necessary to use therelative location information about the primers, although in oneembodiment it can be used as a confirmatory factor.

This model assumes that attacks do not involve further use ofsophisticated binary modification tools. For example, rearranging thebasic blocks a second time would almost certainly eliminate many of thepatterns in the binary. However, such attacks are unlikely ifobfuscations such as those described elsewhere in this document havebeen applied, as they will likely cause such tools to operate poorly, ifat all, and when modifying binaries even a small error produces unusableoutput. Even if an attacker successfully rewrites the binary, unless hedoes so in a way that explicitly eliminates all of the watermarks, moreadvanced techniques (e.g., correlation) can be used to recover watermarkdata given a statistical understanding of the watermark alphabet.

Thus, an original-based watermarking scheme such as that described abovemay give the owner an added advantage over the attacker, since the ownerknows where the marks are supposed to be and the attacker does not. Thelocations of the marks need not be embedded in the code, but can bestored separately. A disadvantage of such a scheme is its lack ofgenerality; reading of marks is generally not possible on arbitrarycode, only on code for which the appropriate data are available. This isnot necessarily a disadvantage when there are only a few versions of theprogram, but with large-scale customization, the database overhead maybecome significant. Another potential disadvantage of this scheme isthat managing all of the lists—especially for a program that is widelydistributed—can be relatively cumbersome. However, as shown below, thesecosts will typically be manageable.

The following example provides some indication of the upper bound on thestorage requirements and cost of an original-based watermarking schemesuch as the one discussed above. Assume that for each program 2202(i.e., release), ten thousand distinct versions 2204 are created throughbinary modification. As shown elsewhere herein, ten thousand versions isprobably more than enough to deter plausible collusive attacks. The timetaken to generate this many versions can be reduced by performing thecustomizations automatically and/or in parallel using a batch mode. Alsoassume that over a period of five years, there are one hundred differentreleases, each of which has ten thousand different versions. Thus, afterfive years, there will potentially be instances of one million distinctversions in the field.

Assume that each version reserves space for a ten kilobyte watermark—asmight be the case if a particularly collusion-resistant anddamage-tolerant mark were desired. If the watermark is divided into tenthousand, one-byte components, each of which is embedded in a separatelocation, then the list for each version of the program may include tenthousand entries, one for each component of the watermark. The listmight also contain a copy of the eight bytes before the marked location,a copy of the eight bytes after the location, and a relative two byteoffset to the next location. Thus, each entry in the list may consist ofapproximately 18-20 bytes of information. Since the list has 10,000entries, storage for each version's list would be approximately 200kilobytes.

Thus, over five years, one million of those 200 kilobyte lists—or 200gigabytes—would be generated. Assuming a storage cost of five dollarsper gigabyte (which will probably decrease over the five year period),the one million lists could be stored for approximately $1000. It mayalso be desirable to keep copies of each of the one hundred programreleases and the customization parameters for each of the 1,000,000versions, but this would be relatively small in comparison. Even if anentire copy of each of the 1,000,000 versions were maintained, thememory requirements—assuming a five megabyte program—would beapproximately 5000 gigabytes.

5. Dynamic Watermarks

In contrast to static watermarks, such as those described above, whichcan be detected by analyzing the static image of the program, dynamicwatermarks can be detected only (or most-easily) by analyzing theexecutable as it is running. For example, the program may produce aspecial output when presented with a special input, the special outputserving as the watermark. Dynamic watermarking techniques are related tosoftware “Easter Eggs,” which typically consist of humorous orunexpected information or behavior embedded in a program and accessibleonly by entering a very specific, and typically unusual, sequence ofkeystrokes or other commands. For example, Microsoft® Excel 97 containsan Easter Egg that can be found by opening a new worksheet, pressing theF5 key, typing X97:L97, pressing the enter (or return) key, pressing thetab key, then holding down the CTRL and SHIFT keys while using a mouseto click on the “Chart Wizard” icon on the program's toolbar. Uponcompletion of this input sequence, a primitive flight simulator isdisplayed. Located within the flight simulator is a sign showing avariety of messages and the names of the program's creators. Additionalinformation on Easter Eggs can be found at http://www.eeggs.com.

Dynamic watermarks can be inserted in a variety of ways and can take avariety of forms. For example, in addition to marks that vary theprogram's output when presented with a special input, dynamic watermarksmay also be encoded in, e.g., variations in the program's run-timeperformance, variations in the program's memory access characteristics,variations in the program's caching behavior, variations in theprogram's dynamic control flow, and/or other program characteristics.

For example, subtle changes could be made to the program's internalprocessing logic so that results would be invariant for “legal” or“expected” inputs, but would differ for special inputs or inputsequences. It should also be noted that dynamic watermarking is a goodcandidate for combination with obfuscation, since obfuscation mayinclude highly complicated calculations designed to make it difficult todetermine what is going on. Minor changes in those calculations mighthave no effect on ordinary user-visible processing, yet causedifferences when specific sequences are input into the program.

It will be appreciated that enabling a program to produce a specialoutput or other dynamic watermark will typically entail making somechanges to the static image of the program, and thus it wouldtheoretically be possible to detect a “dynamic” watermark by analyzingthe static program image. However, the idea behind dynamic watermarkingtechniques is that recovering the mark via static analysis can be madequite difficult, whereas detecting the mark with the special input canbe quite simple. Thus, dynamic watermarking techniques make goodcandidates for use with in-the-field and/or real-time detection systems.The detection system will preferably record the special input in aprotected and/or tamper-resistant environment, and can check for thepresence of the watermark by applying the special input to the programand examining the program's response.

As mentioned, one possible dynamic watermarking technique is to design aprogram so that it reveals a watermark when presented with a specialinput. An advantage of this approach is that virtually anyfunctionality-preserving transformation (e.g., basic-blockreorganization) used by attackers will also preserve the watermark.Another advantage is that it may be much more difficult to detect theexistence of a watermark that is not stored statically in the program.

Detection of the code that creates the watermark can be made quitedifficult, especially if the code is obfuscated, since the program mayinclude a number of code segments that perform complicated operations,some of which hide predicates, others of which generate a watermark.Since much or most of the precision of some obfuscated operations may be“wasted,” there will often be ample room for instance-basedcustomization. For example, the program might calculate a multi-bitvariable and then base an operation, such as a jump, on whether thevariable is odd or even.

The strength of this type of watermarking technique can be increased byspreading the effects of the watermarking code beyond the generation ofthe watermark. For example, in the illustration given above, oneinstance of the program might check an obscure value to see if it iseven and condition a jump on the result, as described above; while asecond instance may condition the jump on the value being odd. Thus, inthe first program instance the watermark is detected if the value iseven, while in the second instance the watermark is detected if thevalue is odd. This would make it more difficult to strip out thewatermark and would also make it more difficult to replace one watermarkwith another. Cleverly embedding the watermark deeply into the programcan make it virtually impossible to remove, particularly since thewatermark consists of a relationship between a particular input and aparticular output, and the attacker will typically not know which inputis used.

Dynamic watermarking generally requires a detailed understanding of theprogram's functionality, and is best carried out at the source-codelevel. As such, it is typically not feasible to dynamically watermarkgeneric third-party software, since such software will usually beobtained in executable or object code form. However, it is typicallyunnecessary to hardwire the watermark in the source code and build itseparately for different copies. The source-code can create some primeddata structures in the image, which can subsequently be stamped tocreate the specific watermark.

6. Priming and Stamping

A variety of advantageous locations have been described in which toinsert watermarks, and it will be appreciated that watermarks can beinserted into these locations using any suitable technique, includingconventional watermarking and software editing techniques. A problemwith conventional watermarking techniques, however, is that they oftenrequire significant computational power, time, and/or memory. This canbe particularly unsatisfactory if one wishes to place a unique watermarkor fingerprint in individual instances of a piece of software or othercontent, or if one wishes to delegate the responsibility for insertingsuch a watermark to another party.

The present invention provides systems and methods for reducing thecomputational resources needed to apply watermarks, and for facilitatingmore flexible relationships between the parties responsible forinserting watermarks into a given medium. Specifically, in oneembodiment watermarks are inserted using a novel, hinted watermarkingprocess that will, for convenience, be referred to as “priming andstamping.” Marks are inserted into the substrate in two stages. In thefirst stage, known as “priming,” parameterized holders are createdand/or identified. During the second stage, known as “stamping,” marksare written into the “primed” holders.

Priming and stamping can be used to minimize the impact thatwatermarking individual program instances has on program development anddebugging. For example, in one embodiment the source code need not berecompiled for differently watermarked copies; instead, the program canbe primed before compilation and different marks can then be stampedinto different copies of the compiled program, which will typically takemuch less time than compiling differently-watermarked versionsseparately. In addition, priming and stamping can be performed withoutthe aid of special tools for analyzing or instrumenting executables, andtypically does not require the rearrangement of compiled code.

The priming and stamping process is described in more detail withreference to FIGS. 24 and 25. As mentioned above, priming and stampingsplits the watermark insertion process conceptually into two generalphases. In principle, virtually any watermarking algorithm can be splitinto multiple phases using standard algorithm manipulation techniques.However, it will generally be more efficient to use algorithmsspecifically designed to be split.

As shown in FIG. 24, in the first phase, preferably performed once perprogram, the unwatermarked program 2400 is primed (2404) by insertingcode that is operable to create space and/or a framework for insertingmarks. As shown in FIG. 24, priming step 2404 may be preceded by anoptional analysis step 2402, in which a determination is made as to howand where marks can be embedded. Analysis step 2402 may, for example,consist of determining whether the insertion of a watermark into aparticular area of the program would adversely affect the program'sperformance, as might be the case if a lengthy executable watermark wereadded to a frequently-executed loop.

In the second phase, the watermark payload is embedded in the programusing the hints (or primers) that were inserted by priming step 2404.That is, primed program 2406 is stamped (2410) by replacing the primerswith customized watermark data. As shown in FIG. 24, in some embodimentsprimed program 2406 may undergo one or more transformations 2408 priorto stamping 2410. For example, if primed program 2406 is in source codeform, transformation 2408 may include compiling the source code intoobject code form. Or, if primed program 2406 is already in object codeform, transformation 2408 may include linking the object code to form anexecutable. The primers inserted in priming step 2404 are preferablyable to withstand such transformations, or to react to suchtransformations in a predictable manner, such that stamping step 2410can locate the primers and apply the appropriate stamps.

FIG. 25 illustrates the priming and stamping process in further detail.Referring to FIG. 25, one effective technique for inserting primers intoa program is by using a collection of macros and/or inlined functions.The macros and inlined functions can be called in a number of locationsthroughout the program. When an executable is created, a standardpre-processor and/or compiler will expand the macros or insert thefunction code into the program at each location at which the macro orinlined function was referenced. Thus, the macros and inlined functionscan be transparently inserted into the source code without substantiallychanging the semantics of the code and without requiring the programmerto know much, if anything, about the macro's and/or function'simplementation. Although some knowledge of the system structure may beneeded to insert the macros optimally—for example, placing lengthymacros in frequently-executed code may negatively affect the program'sperformance—sufficient knowledge to perform adequate placement cangenerally be obtained empirically using well-know code analysis toolsand techniques.

As shown in FIG. 25, after compilation and preferably after any othercustomizations have been made to the program, a binary imagepostprocessor can be used to find the primers 2504 created by macros2502 and inlined functions 2503 in the binary image 2500 b of program2500 a. The desired marks 2506 can then be inserted into the binaryimage at the locations reserved by the primers.

It will be appreciated that primers can be inserted into the program inany suitable manner. While a combination of macros and inlined functionswere used in FIG. 25, in other embodiments, other techniques are used.For example, the code for creating the primer could, instead, beinserted directly into the program. In a preferred embodiment, themacros and inlined functions are relatively stealthy (e.g., they blendinto the program). The Markov modeling and other statistical analysistechniques described elsewhere herein can be used for this purpose. Itshould be appreciated, however, that the macros and inlined functionsthat are used can take any suitable form.

It will typically be desirable to use a library of several macros and/orinlined functions, since if one copy of the code is discovered it mightbe possible to discover other copies inserted using the same macro orinlined function. One general category of containers embeds its contentin the data section of the executable, and another general categoryembeds its content in the code section. For example, the following wouldinsert its content in the data section, whereas the inlined functionswould insert its content in the code section.

#define InsertWatermarkPrimer1( ) {static int X[N] = {PRIMER0, PRIMER1,... };

In a preferred embodiment data section primers are implemented as macrosrather than inlined functions, since different invocations of a macroresult in separate static variables, while different invocations of aninlined function share a single static variable. Thus, a macro createsmultiple copies of the primers, while the inlined function does not. Itshould also be noted that since the macro is enclosed in a block, itwill not cause collision of variable names with the containing block. Itmay also be inserted multiple times within the containing block withoutfear of redefining names.

If primers are inserted using macros and/or inlined functions, it willtypically be desirable to ensure that the pre-processor and/or compilerinserts enough copies of the macros and/or functions to provide adequatespace for storing the marks during stamping. The appropriate number fora given application can be readily determined by simple trial and errorexperimentation.

In one embodiment the priming process also involves the insertion ofsource code to hold the watermark and to hide the “uselessness” of thewatermark to the overall execution of the program. This code can bethought of as a “container” for the watermark. In general, a watermarkcontainer may hold its content in a sequence of possibly non-adjacentslots. At compilation, the content of the container is set to a specialpedefined pattern (i.e., the primer), which helps locate the watermarkcontainer for stamping.

Watermarks inserted in this manner may have two parts: (i) modifiablecontent, which is stamped with customized data; and (ii) a fixedcontainer which is set at priming and preferably not modified duringstamping. The container serves to blend the marks into the program. Itmay also provide registration information for locating the marks.

The primer pattern that is initially filled into the watermark holder isused to identify the locations to stamp. The pattern is preferably longenough (e.g., at least 32 bits) that it is simple to find primers thatdo not occur naturally in the software. It will typically be importantto ensure that the pattern used to locate the watermark holders does notresult in false matches, since unintended stamping can corrupt thesoftware. One technique for protecting against unintended stamping is tocount the number of primers that were found, which should match thenumber that were originally inserted.

The pattern constituting the container may be used to locate the primerwith greater reliability. For example, in the context of a code-sectionwatermark, we look for the primer slots as well as the interveningopcodes in the container. An extension of this approach is to rememberthe locations where the primer can be found. The location informationcan be used to speed up the stamping procedure by avoiding (or reducing)the need for pattern matching.

6.1. When?

One of the powerful aspects of priming and stamping is that it enablesoperations performed at the source-code level (e.g., the insertion ofinlined functions or macros) to hint the assembly code, thus enablingthe entity in charge of stamping the code to quickly and easily find thelocations that can be stamped and apply the watermark thereto. Thus,priming and stamping allows the watermarking process to be convenientlydivided between several parties over a period of time.

The priming and stamping steps can be performed in variety of ways andat a variety of different times during a program's creation. Forexample, priming can be performed at the source code level, duringcompilation, and/or after compilation. In one embodiment the source codeis primed with assembly language patterns and compiled. The patterns canbe found in the object code or executable by performing byte-levelpattern matching. In another embodiment the compiler itself can bemodified to identify resources (i.e., prime the program) and/or togenerate differently-stamped copies. Such a technique is able togenerate highly stealthy marks (e.g., register re-allocation orplacement of variables), although the insertion process can berelatively slow. In yet another embodiment the code is primed aftercompilation, but before linking. The code can then be linked and/ordistributed to others and primed. Another option is to modify a standardlinker to perform priming and/or stamping. In yet another embodiment,the program is primed and stamped in executable form (i.e., after thelinking process).

Like priming, stamping can be performed in a variety of ways. Forexample, in one embodiment individual copies of a program are stampedwith a unique watermark prior to distribution. Alternatively, or inaddition, program copies can be stamped as part

of the process of activating or installing the program on a user'scomputer. For example, the user could be prompted to connect via anetwork to a computer that supplies the stamps to a protected processingapplication on the user's computer that would apply them to the program.Although stamping could be performed in an obfuscated and/or protectedenvironment on the user's computer to prevent giving away the locationof the watermarks, stamping at the user's computer may be somewhat lesssecure than stamping the program before distribution to the user, as theuser will initially have an unstamped version of the program (or atleast portions thereof). However, this may not be a great concern insome applications.

FIGS. 26 and 27 illustrate one such technique. As shown in FIG. 27,after a program has been written (2700), the program's code is primed ormarked (2702). Priming can be done at the source code level, although itshould be appreciated that priming could alternatively (or additionally)occur at the object or binary code level. In one embodiment, multipleprimers are inserted into the code, each primer being chosen from apredefined set of distinct types (e.g., 10 distinct types). For example,in one embodiment 500 primers of 40 bytes each (on average) are insertedinto a 1 megabyte program. It will be recognized that the optimumplacement of the primers within the program, as well as the optimumnumber (and size) of primers to use, will depend on the particularapplication.

After compilation (2704), the program executable can be customized(e.g., obfuscated), taking care to preserve the primers (2706). Tofacilitate this process, the positions of the primers can be made knownto the customization tool, so that it can avoid altering them. This canbe accomplished in a variety of ways. For example, the customizationtool can access the primer reading tool directly (e.g., through DLLcalls), and/or the primers can be marked with signal flags indicatingthat a particular section of code is not to be customized. In anotherembodiment, a primer reading tool is used to generate a file thatprovides the locations of the primers, and this file is provided to thecustomization tool. In yet another embodiment some or all of the primersare simply inserted after customization.

After customization,in one embodiment each instance of the program isgiven credentials. This can be accomplished, for example, by computingone or more hash values (using a suitable hashing algorithm, such as MD5or SHA-1) for one or more program locations, preferably not includingthe primed regions. As shown in FIG. 26, after the credentialing step,each customized, primed instance of the program can be split into arelatively large part 2604 consisting of most of the executable program,and a smaller part 2606 containing the watermarks or primed locationsand/or other security-relatedcode (and an indication of where smallerpart 2606 belongs in code 2604) (2708). Code 2604 can contain lengthpreserving holes where the remaining code (e.g., code 2606) would go. Inone illustrative embodiment most or all of these holes are filled withNOPs to add stealth. In another embodiment the holes are removed, thuseffectively disabling code 2604 due to addressing misalignment.

Code 2604 may be encrypted, packaged, and sent to customers 2612, 2614and/or distribution centers 2608 (2710, 2712). The appropriate patches2606 for each customized instance of the program 2604 are stored at aserver 2610 in a list 2616 (2714). Thus, when a customer installsprogram 2604, the appropriate patches 2606 can be supplied by server2610. For example, as shown in FIG. 26, at installation a customer 2612contacts server 2610 via a network 2618 such as the Internet. Customer2612 supplies information regarding the identity (e.g., credentials) ofthe customized version of the program that the customer received in theinstallation package. Server 2610 retrieves the corresponding patches2606, watermarks them (e.g., if they were not already watermarked),compresses and encrypts them (using, e.g., DES or any other suitableencryption technique), and transmits them to the customer. Thecustomer's system decrypts and decompresses the program and the patchesand merges them to form a functioning watermarked program. In apreferred embodiment, the decryption and decompression occurincrementally and concurrently.

In another embodiment, the patches 2606 can be stored on, e.g., the diskon which program 2604 is stored, and the installation program can applythe appropriate patches. It will be recognized that if patch files aredistributed from a server 2610, there will be a tradeoff betweensecurity and ease of installation. On the one hand, patch files shouldbe relatively small in order to limit the communication overhead oftransmitting them from the server to the client. On the other hand,better security can generally be achieved if the patch files includedecoy blocks that contain no watermarks, or if the patch files includerandom intervals around the watermarks to mask the watermarks' exactlocations.

Additional description of priming and stamping can be found in theSoftware Self-Defense application.

7. Combinations of Techniques

It will be appreciated that the watermarking techniques described hereincan be advantageously used in combination with each other and/or withthe obfuscation, tamper resistance, and other software self-defensetechniques described in the Software Self-Defense application and the'346 application. For example, as previously described, obfuscationmechanisms such as opaque predicates can be used to help disguisewatermarks that are hidden in unexecuted code or unused data.

Obfuscation techniques can also be used to provide the watermarksthemselves. If the program is obfuscated, e.g., in the manner describedin the Software Self-Defense application, the pseudo-random nature ofthe obfuscation techniques will permit information to be embedded in thebinary program by adjusting the choices made during the obfuscationprocess. That is, each choice of whether to apply obfuscation or notrepresents a bit of information (and choices of multi-bit valuesrepresent multiple bits), and the resulting program contains theencoding of all those bits. Recognizing such encodings can be difficult,in that it requires (at worst) a catalog of all the generatedwatermarked versions to compare against individually (or the ability tore-generate such a catalog at will). However, signature recognition andother pattern-matching techniques can substantially reduce thecomputational burden of recognizing such mark encodings even in the faceof significant damage to the marked version.

8. Protection of Watermarks

A variety of techniques can be used to protect watermarks from detectionand removal. In addition to those techniques described previously, manyof the software self defense techniques described in the SoftwareSelf-Defense application can be advantageously used for this purpose.

8.1. Self-Checking

One method of protecting watermarks from corruption or removal is toinclude code that performs self-validation at run time. For example,code can be inserted that computes the hash of a region of memory at runtime, compares the computed hash value with an expected value, andinvokes a tamper response mechanism if the two do not match. Theself-validation test need not be focused solely on the watermarks, butcan instead test a wide range of memory that includes one or morewatermarks or portions thereof. The tests are preferably stealthy andrecursive, such that tampering with one test is likely to cause anothertest to fail. Additional self-validation techniques are described in theSoftware Self-Defense application.

8.2. Obfuscation

Software obfuscation techniques such as those described in the SoftwareSelf-Defense application and the '346 application can also be used toprotect watermarks from detection or removal. In addition to usingspecific obfuscation techniques and constructs directly in connectionwith encoding and embedding watermarks in a piece of software, thegeneral application of obfuscation techniques will typically also helpto protect the watermarks contained in the program, as the moredifficult the program is to understand, the more difficult it will befor an attacker to identify the watermarks.

In addition, and as described elsewhere herein, obfuscation techniquescan be specifically used to protect watermarks and/or to obscure theirrelation to the program. For example, obfuscation techniques such asopaque predicates can be used to make watermarks appear as though theyaffect the program's behavior, thus reducing the chances that anattacker will discover the watermarks by searching for useless code ordata.

An example of an opaque predicate is a function or expression thatalways evaluates to a particular value or values—e.g., true orfalse—regardless of its input, but is coded such that it is difficult todeduce this. Such a function can thus be used in, e.g., a code branch tomake it look like certain code or data might affect the program'sbehavior, when in reality, the code or data are never reached due to thefact that the condition never evaluates in that direction. Additionalexamples of opaque predicates and their use can be found in the SoftwareSelf-Defense application, the '346 application, and in the Cohen paper,each of which was previously incorporated by reference herein.

In one embodiment, a watermark and an opaque predicate are combined intoa single standardized macro or inlined function so that the opaquepredicate is executed in the scope of the watermark. The standardizedinterface also makes it easy to interchange the opaque predicates thatare used. The following is an example of such a macro interface inaccordance with an embodiment of the present invention.:

-   -   int OpaquePredicate(int size, int *array);

Another issue is the choice of the obfuscation code for the branch thatthe opaque predicate never takes. In one embodiment the obfuscationbranch loops back to the opaque predicate. Note that successive calls tothe opaque predicates described above differ in the values of theirstatic variables. In a preferred embodiment, the obfuscation code istailored to look like useful code in the host program.

#define InsertWatermarkPrimer1( ) {\ static int X[5] = {PRIMER0,PRIMER1, ... };\ while (OpaquePredicate1(5, X));\ }

The code rearrangement and/or other obfuscation and tamper resistancetechniques described in the Software Self-Defense application alsoprovide powerful resistance to cropping and/or deletion attacks, asthese techniques generally make identification of a useful part of theprogram more difficult.

Relatively weak obfuscation, tamper resistance, and/or watermarkingtechniques can be used to decoy the operation of more effectivetechniques. For example, decoys can be used to lure the attacker intomaking program modifications that will break the program or triggerdetection of the attacker's activity. For example, having detected aweak watermark or obfuscation technique, the attacker might pressforward with eradicating or counteracting it, and not realize that in sodoing, he has triggered other, more subtle defensive measures. Forexample, when removing a weak watermark, the attacker could be luredinto making changes to the program binary that would cause the programto fail built-in self-checks, crash or yield incorrect results, and/ortrigger communication with an external detection agent.

8.3. Customization

Customizing different instances of a watermarked program makes it harderto identify or remove the watermarks. For example, as describedelsewhere herein, customization can make a collusive attack much moredifficult by making randomly-picked copies difficult to compare.

Since it may be relatively expensive for a company to generate adifferent customized copy of a program for each customer, a probabilitywill exist that attackers will be able to get multiple copies of theprogram with the same customization. However, as shown above, theprobability of getting c copies with the same customization decreasessteeply with c. That is, it will typically be much more difficult toobtain ten copies of a program with the same customization than it willbe to obtain two copies. Thus, it will usually be sufficient to resistonly a small degree of collusion. On the other hand, the space overheadof anti-collusion encodings typically increases relatively steeply withthe degree of collusion to be resisted, so it will generally bedesirable to assure a relatively low degree of collusion by producing asufficiently large number of differently-customized versions.

8.4. Stealth

Watermarks can also be protected by making the marks and/or theircontainers blend in with the rest of the program. As described above,watermarks and/or their containers can be made stealthy by using avariety of techniques. For example, watermarks and their containers canuse common opcodes, opcode sequences, operands, addressing modes,prefixes, and the like. Statistical modeling techniques can be used tofurther ensure that the watermarks and containers look like the rest ofthe code/data in the program. In addition, stealth can be provided bymaking watermarks and/or containers relatively small. For example, aholder could consist of a single instruction. Stealth can also beenhanced by minimizing the range of possible values used for eachcontainer, given the constraints imposed, or made desirable, by otherdefensive techniques, such as those used to counter forgery orcollusion.

8.5. Anti-Debugging

Attackers might attempt to use a debugging tool to analyze the structureand operation of a program in an effort to locate, remove, or forgewatermarks. Thus, one way to protect watermarks is to include mechanismsthat detect, hinder, and/or prevent the use of debuggers. A variety ofsuch mechanisms are described in the Software Self-Defense application,any suitable ones of which could be used.

Although the foregoing invention has been described in some detail forpurposes of clarity, it will be apparent that certain changes andmodifications may be practiced within the scope of the appended claims.It should be noted that there are many alternative ways of implementingboth the processes and apparatuses of the present invention.Accordingly, the present embodiments are to be considered asillustrative and not restrictive, and the invention is not to be limitedto the details given herein, but may be modified within the scope andequivalents of the appended claims.

Appendix A

Here we analyze the strength of the two-layer collusion-resistantwatermarking code described above in Section 3.7.1.

The analysis that follows assumes generally that:

-   -   The bits constituting the watermark (or “fingerprint”) are        inserted at secret locations, such that an attacker can detect        the location of a bit only by comparing copies that differ in        that location;    -   An attacker cannot alter fingerprint bits that are undetected.        (Note, however, that in practice the analysis that follows will        still hold true even if an attacker alters bits randomly, as        long as the fraction of undetected fingerprint bits that are        altered is small).    -   The provider uses a private decoder to infer the identity of a        colluder.

It will be appreciated; however, that while the following analysis isbased on these assumptions, the practical encoding techniques to whichthe analysis relates can be used even if one or more of theseassumptions is not met, or even if some of the conditions or“requirements” set forth below are not satisfied. While, in such asituation, the encoding scheme may not enjoy the same level oftheoretical strength as one which satisfies the assumptions andrequirements set forth herein, one of ordinary skill in the art willappreciate that in many cases the level of strength that such anencoding scheme is able to provide will, depending on the applicationand the expected sophistication of attack, be adequate. Thus, thefollowing analysis should be considered illustrative and not limiting asto the scope of the present invention.

1. Analysis

Suppose c fingerprints are used in an attack to create a corruptedfingerprint. We will refer to the c fingerprints as the “colludingfingerprints.” The provider decodes the corrupted fingerprintsuccessfully if some colluding fingerprint has a higher match than allnon-colluding fingerprints.

It is possible for attackers to decrease the match of one colludingwatermark at the cost of increasing the match of other colludingfingerprints. However, attackers need to minimize the maximum suchmatch, so the strongest attack keeps the matches of all colludingfingerprints roughly the same. Assuming such an attack, it suffices tostudy the match of a randomly-chosen colluding fingerprint. Let,

f_(r)=the corrupted fingerprint

f_(c)=a colluding fingerprint, chosen randomly

f_(a)=an assigned fingerprint, chosen randomly

For decoding to succeed, a symbol in f_(r) should be more likely tomatch the corresponding symbol in f_(c) than it is to match thecorresponding symbol in f_(a). Let,

m_(c)=probability that a symbol in f_(r) matches the correspondingsymbol in f_(c)

m_(a)=probability that a symbol in f_(r) matches the correspondingsymbol in f_(a)

M(f)=match of f

If (m_(c)>m_(a)), it is possible to increase the number of symbols in afingerprint, n, to arbitrarily increase the probability that theM(f_(c))>M(f_(a)). In this case, the probability of decoder error can bereduced arbitrarily. Let,

e ₁ =P{M(f _(c))≦M(f _(a))}, for a randomly-chosen f _(a)

e=probability of decoder error

=P{M(f _(c))≦M(f _(b))}, for at least one non-colluding fingerprint f_(b<u*e) ₁

Section 2, below, entitled “The Length of the Outer Code,” shows how e₁reduces as n increases. However, if m_(c) is not greater than m_(a),increasing n will not help the code resist collusion.

Next, we compute m_(c) and m_(a) under various forms of attacks. Forsimplicity of analysis, we assume that, if attackers detect one bit in asymbol, they detect the entire b-bit representation. This may actuallyhappen if the bits of a symbol are located together in the fingerprintedcontent. In any case, this assumption is conservative: without it, thecode would be more secure.

Let,

X=multi-set of c symbols found in some random position of the colludingfingerprints

If all symbols in X are identical, the colluders cannot detect thissymbol position, so the corrupted fingerprint f_(r) contains the samesymbol at that position. The fraction of symbol positions that remainundetected is expected to be:

h=1/q ^(c−1)

In an undetected position, f_(r) matches f_(c) perfectly and matchesf_(a) with probability 1/q. Therefore,

m _(c) =h*1+(1−h)*m _(c)′

m _(a) =h*1/q+(1−h)*m _(a)′

where,

m_(c)′=probability that a detected symbol in f_(r) matches thecorresponding symbol in f_(c)

m_(a)′=probability that a detected symbol in f_(r) matches thecorresponding symbol in f_(a)

If the colluders detect a symbol position, they can set thecorresponding symbol in the corrupted fingerprint in the following ways:

Retain Attack: An attacker might retain a symbol from X. In this case,m_(a)′=1/q and m_(c)′=y/c, where y is the number of times the retainedsymbol occurs in X. The strongest such attack would minimize m_(c)′ byretaining the minority symbol in X. If there were always a minority of1, m_(c)′=1/c. This suggests that if q<c, m_(c)′ might be less than ma,which might cause m_(c) not to be greater than m_(a), causing the codeto fail. This is the case when q=2 and c=3. In this case, detectedsymbol positions always have a minority of one, so:

m _(c)′=⅓

m _(a)′=½

h=¼

m _(c)=¼+¾*⅓=½

m _(a)=¼*½+¾*½=½

In fact, we have found through simulations that even when the expectedoccurrence of the minority symbol in X is greater than 1 (true for c>3),the code fails when q<c. On the other hand, if q≧c, we know thatm_(c)′≧m_(a)′, so m_(c)>m_(a), and the code is secure provided n issuitably large.

Forge attack: In a forgery attack, the attacker forges a symbol notfound in X. However, the set of valid symbol representations at anyposition is private to the provider. Therefore, the colluders cannotforge a valid symbol representation except by chance. (If the colluderscould forge a valid symbol, they would gain a significant advantage:m_(a)′=1/q and m_(c)′=0, causing the code to fail). Let,

$\begin{matrix}{g = {{probability}\mspace{14mu} {that}\mspace{14mu} a\mspace{14mu} {randomly}\mspace{14mu} {chosen}}} \\{{{representation}\mspace{14mu} {outside}\mspace{14mu} X\mspace{14mu} {is}\mspace{14mu} {valid}}} \\{{= {\left( {q - z} \right)/\left( {2^{b} - z} \right)}},}\end{matrix}$where  z = number  of  distinct  symbols  in  X   < q/2^(b)

Using the conservative value for g,

m_(c)′=0

m _(a) ′=g/q=½^(b)

Now we can compute the value of b needed to withstand attack.

m_(c)=h

m _(a) =h/q+½^(b)

For m_(c)>m_(a),

$\begin{matrix}{{b > {\log \; \left( {{q/\left( {q - 1} \right)}*{1/h}} \right)}} = {\log \; \left( {q^{c}/\left( {q - 1} \right)} \right)}} \\{= {{c*{\log (q)}} - {\log \; \left( {q - 1} \right)}}}\end{matrix}$

Therefore, a conservative value for b is greater than c*log(q).

Note that when q≧c, the minority-retain attack results in(m_(c)′≧m_(a)′) while the forge attack results in (m_(c)′<m_(a)′).Therefore, when q≧c, the forge attack is stronger.

2. The Length of the Outer Code

Here we show how e₁ decreases with n. M(f_(c)) is a binomial variableB[n, m_(c)]. Similarly, M(f_(a)) is B[n, m_(a)]. For large n, B[n, p] isroughly normal, N[n*p, n*p*(1−p)]. If M(f_(c)) and M(f_(a)) areindependent, their difference is roughly normal too, N[n*(m_(c)−m_(a)),n*(m_(c)*(1−m_(c))+m_(a)*(1−m_(a)))]. Therefore,

e ₁ =P{M(f _(c))−M(f _(a))≦0}<exp(−n/2*(m _(c) −m _(a))²/*(m _(c)*(1−m_(c))+m _(a)*(1−m _(a))), by Laplace limit

Therefore, it is sufficient to set n as follows to keep probability ofdecoder error under e:

n>2*(m _(c)(1−m _(c))+m _(a)(1−m _(a)))/(m _(c) −m _(a))²*log(u/e)

Suppose b=c*log(q)+1. Then,

m _(c)=1/q ^(c−1)

m _(a)=1/q ^(c)+1/(2q ^(c))=3/(2q ^(c))

So a sufficient value for n is,

n = 2 * (1/q^(c − 1) + 3/(2q^(c)))/(1/q^(c − 1) − 3/(2q^(c)))² * log (u/e) < 2 * 7/(4q^(c − 1))/(1/(2q^(c)))² * log  (u/e),      since  1/q^(c − 1) ≥ 2/q^(c) = 2 * 7 * q^(c + 2) * log (u/e)

When q=c,

n=14*c ^(c+2)*log(u/e)

Note that the bit length of the watermark isn*b=14*c^(c+3)*log(c)*log(u/e).

1. A method for watermarking computer code, the method comprising:inserting one or more encrypted marks into the computer code, each ofthe one or more encrypted marks being formed by creating a copy of amark; combining extra information with the copy of the mark to create amodified mark; and encrypting the modified mark to create one of the oneor more encrypted marks.
 2. A method as in claim 1, wherein the extrainformation is randomly generated.
 3. A method as in claim 1, wherein aplurality of encrypted marks are inserted into the computer code.
 4. Amethod as in claim 3, wherein each encrypted mark in the plurality ofencrypted marks differs from any of the other encrypted marks in theplurality of encrypted marks.
 5. A method as in claim 3, wherein extrainformation combined with a copy of the mark differs from extrainformation combined with any other copy of the mark.
 6. A method as inclaim 1, wherein at least one of the mark and the extra informationincludes a digital signature.
 7. A method as in claim 6, wherein thedigital signature is a function, at least in part, of one or more of themark and the extra information.
 8. A method as in claim 6, wherein arecipient of the computer code decodes at least one of the encryptedmarks in the set of encrypted marks inserted into the computer code tocreate a set of decoded marks and checks one or more of the decodedmarks in the set of decoded marks for the digital signature.
 9. A methodas in claim 1, further comprising combining the encrypted mark withplaintext information.
 10. A method as in claim 9, wherein a recipientof the computer code decodes at least one of the one or more of theencrypted marks inserted into the computer code to create a set ofdecoded marks and for each decoded mark in the set of decoded marks, therecipient identifies the extra information in the decoded mark; andcompares the extra information with the plaintext information.